147

Is it possible to call a javascript function from the URL? I am basically trying to leverage JS methods in a page I don't have access to the source.

Something like: http://www.example.com/mypage.aspx?javascript:printHelloWorld()

I know if you put javascript:alert("Hello World"); into the address bar it will work.

I suspect the answer to this is no but, just wondered if there was a way to do it.

NaN
  • 7,441
  • 6
  • 32
  • 51
DazManCat
  • 3,540
  • 5
  • 30
  • 33
  • 4
    What behaviour would your URL have to display - do you want to execute Javascript in the context of that site? – Pekka Nov 12 '10 at 10:54
  • 1
    The `http:` at the start of the URI tells the browser "I want you to make an HTTP request", so HTTP request it does. There is no way around it, I think. – Constantin Nov 12 '10 at 11:29
  • 9
    If I paste `javascript:alert("Hi");` into my Firefox (28.0) address bar and press Enter, nothing happens. Maybe this has been disabled? ... Yes, apparently it has been disabled because idiots could be convinced to paste anything into their address bar. Found the info here: http://stackoverflow.com/a/18782801/111036 – mivk Apr 06 '14 at 11:11
  • 2
    copy paste doesn't work, but if you type it, it works, looks like it not disabled, but parsed when pasted. – Bhabani Sankar Mishra May 15 '17 at 07:09
  • 2
    Note: it only works in Firefox when 1. you're on an actual (not empty) page and 2. you explicitly put "javascript:" before it. – Andrew Jun 19 '17 at 22:52
  • 1
    Good question though. :) I would assume though that reacts as a param and invalid character call since URL http get action considers anything following '?' a parameter. Also, this would be a client side security threat. – Casey ScriptFu Pharr Jul 07 '17 at 19:55

14 Answers14

73

There isn't from a hyperlink, no. Not unless the page has script inside specifically for this and it's checking for some parameter....but for your question, no, there's no built-in support in browsers for this.

There are however bookmarklets you can bookmark to quickly run JavaScript functions from your address bar; not sure if that meets your needs, but it's as close as it gets.

davmac
  • 20,150
  • 1
  • 40
  • 68
Nick Craver
  • 623,446
  • 136
  • 1,297
  • 1,155
46

You can use Data URIs. For example: data:text/html,<script>alert('hi');</script>

For more information visit: https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/Data_URIs

Waiski
  • 9,214
  • 3
  • 21
  • 30
yassine45
  • 461
  • 4
  • 2
45

Write in address bar

javascript:alert("hi");

Make sure you write in the beginning: javascript:

hfarazm
  • 1,407
  • 17
  • 22
  • 2
    It doesn't work on **Google Chrome** Version 80.0.3987.132 (Official Build) (64-bit). Chrome automatically strips the `javascript:` prefix from the address bar. – stomy Mar 17 '20 at 18:03
  • 15
    @stomy You need to type `javascript:` manually, unfortunately – wjandrea Apr 07 '20 at 18:06
  • 1
    @wjandrea You can, however, create a bookmark (you still have to manually type the prefix) and it will execute the Javascript when you click on it. I've made some pretty neat stuff this way; I believe I heard from somewhere that these are called Bookmarklets. – Feathercrown Apr 23 '22 at 17:23
  • Is it possible that this doesn't work anymore? – principal-ideal-domain Feb 08 '23 at 08:52
  • it works, be sure to type javascript: – hfarazm Aug 21 '23 at 03:32
8

/test.html#alert('heello')

test.html
<button onClick="eval(document.location.hash.substring(1))">do it</button>
Budia
  • 113
  • 3
  • 19
    Note that this evaluating user input is very dangerous practice and should usually not be allowed. – domenukk May 24 '16 at 14:00
  • 8
    Yes, this is quite insane. There are workplaces where you would get fired because of this type of insanity. – Jay Jul 06 '16 at 09:24
  • 7
    This leads to reflected cross-site scripting (XSS) issues as pointed out by @domenukk. – pavanw3b Aug 16 '16 at 05:31
7

About the window.location.hash property:

Return the anchor part of a URL.


Example 1:
//Assume that the current URL is 

var URL = "http://www.example.com/test.htm#part2";

var x = window.location.hash;

//The result of x will be:

x = "#part2"

Exmaple 2:

$(function(){   
    setTimeout(function(){
        var id = document.location.hash;
        $(id).click().blur();
    }, 200);
})

Example 3:

var hash = "#search" || window.location.hash;
window.location.hash = hash; 

switch(hash){   
case "#search":  
    selectPanel("pnlSearch");
    break;    
case "#advsearch":    

case "#admin":  

}
Eddy
  • 3,623
  • 37
  • 44
6

you may also place the followinng

<a href='javascript:alert("hello world!");'>Click me</a>

to your html-code, and when you click on 'Click me' hyperlink, javascript will appear in url-bar and Alert dialog will show

heximal
  • 10,327
  • 5
  • 46
  • 69
3

Using Eddy's answer worked very well as I had kind of the same problem. Just call your url with the parameters : "www.mypage.html#myAnchor"

Then, in mypage.html :

$(document).ready(function(){
  var hash = window.location.hash;
  if(hash.length > 0){
    // your action with the hash
  }
});
EllemKah
  • 31
  • 1
2

you can use like this situation: for example, you have a page: http://www.example.com/page.php then in that page.php, insert this code:

if (!empty($_GET['doaction']) && $_GET['doaction'] == blabla ){
echo '<script>alert("hello");</script>';
}

then, whenever you visit this url: http://www.example.com/page.php?doaction=blabla

then the alert will be automatically called.

T.Todua
  • 53,146
  • 19
  • 236
  • 237
2

Just use:

(function() {
  var a = document.createElement("script");
  a.type = "text/javascript";
  a.src = "http://www.example.com/helloworld.js?" + Math.random();
  document.getElementsByTagName("head")[0].appendChild(a)
})();

This basically creates a new JavaScript line in the head of the HTML to load the JavaScript URL you wish on the page itself. This seems more like what you were asking for. You can also change the a.src to the actual code, but for longer functions and stuff it becomes a problem. The source link can also link to a JavaScript file on your computer if targeted that way.

showdev
  • 28,454
  • 37
  • 55
  • 73
Brandon
  • 21
  • 1
1

No; because it would make links extremely dangerous.

user1133275
  • 2,642
  • 27
  • 31
0

you can execute javascript from url via events Ex: www.something.com/home/save?id=12<body onload="alert(1)"></body>

does work if params in url are there.

0

There is a Chrome extension called Bookmarklet URL (no affiliation). To append a URL with JavaScript, so that the JavaScript command is executed just after loading the webpage, one can use ?bmlet=javascript:

Example: Display an alert box

https://github.com/?bmlet=javascript:alert("Hi");

Example: Enable spell-checking while editing a GitHub README file
[Obviously, a spelling checking extension must be originally available.]

https://github.com/<username>/<repositoryname>/edit/main/README.md?bmlet=javascript:document.getElementById("code-editor").setAttribute("spellcheck","true");

On some pages, it might take some time, as the JavaScript command runs after completely loading the page. Simple commands like alert("Hi"); should run quickly.

GoTrained
  • 158
  • 1
  • 7
0

I am a student and I have just realized my school blocked JavaScript from the address bar. It works with the "a" tag on a .html file but not on the bar anymore. I am not asking for help, I would just like to share this.

jame
  • 11
  • 1
-1

You can do one thing that is you can first open the link www.example.com. Then you can search: javascript:window.alert("Hello World!")

  • Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-ask). – Community Sep 11 '21 at 08:39
  • That's like saying "You can open www.example.com and then click on the button that runs the js". It's not what OP wants – Kleysley Oct 27 '21 at 14:15