August 19, 2002

  • Javascript & Xanga Skins


    Lately many of you have been asking about how javascript works with Xanga Skins. There are two ways of including javascript on your site: placing the javascript code directly in your page source, or including a javascript file from an outside source using the SCRIPT SRC tag.


    Right now you can embed javascript code in your Xanga Skin’s source, but you can’t include a javascript file.


    The reason for doing this is that malicious javascript code can read your cookies and wreck other havoc. Javascript embeded in your source doesn’t suffer from this issue, since we can strip out any malicious code. But an included file is not under our jurisdiction, and can execute any code it wants. Naturally we don’t expect any Xanga user’s to implement such nastiness, but we still have to be careful.


    If you write your own javascript code, I recommend placing it directly in the source of your Skin, rather than using includes (This also makes it easier to share your Xanga Skin in the Skins Directory).



    But for users of Moreover, Sitemeter, Chatterbox, and other services which legitimately use javascript includes, this can be a source of frustration.


    As a solution, we will soon allow javascript includes only from certain “trusted” sites. The list of sites is small right now; Moreover, Sitemeter and Chatterbox seem to be the most popular on Xanga.


    If there are any others you’d like to use, please let us know. And as always, if you have any questions or suggestions on how to improve Xanga’s javascript experience, please share; there are Xangans with some serious javascript kung-fu out there, and we’d love to hear what you think!

Comments (520)

Post a Comment

Leave a Reply

Your email address will not be published. Required fields are marked *