views:

51

answers:

1

I'm wanting to post live jQuery examples in my Wordpress posts, and so need to be able to include working code in the actual post itself. I've turned off the WYSIWYG editor and any settings which may mess up my code when I publish. I've also, through the exec-php plugin, been able to get php code working in-post, but this (admittedly old) article gave me the impression that Javascript (and by extension, jQuery), would work without a plugin.

<script type="text/javascript" src="http://code.jquery.com/jquery-latest.js"&gt; </script>
<script type="text/javascript">
$(document).ready(function(){

    $("#test").text("jimmy");

  });
</script>

<p id = "test"></p>
+2  A: 

It is dangerous to allow posted code to execute javascript. Its a security hole known as XSS. WordPress probably defaults stripping out javascript tags as a security precaution. There may be a setting you can change this behavior in.

Jeremy Wall
I think Wordpress.com strips out Javascript, but this is on a self-hosted site. Surely letting posted code run Javascript is no more dangerous than letting it run PHP? Is it dangerous for visitors or for me?
Chris Armstrong
Because javascript runs on the client it can be dangerous for anyone who visits the site. It's a little different from php which gets run on the server.
Jeremy Wall
Ah right, but is it any different to me putting the javascript in the header of the page? Is the danger there any time you run Javascript on Wordpress or just when you do it in a post?
Chris Armstrong
Putting javascript in the header of the page requires editing the sourcecode. Putting javascript in a post just requires editing a form.One requires access to the files on the server.The other just requires user input on the site.The security concerns are related to those two differences.
Jeremy Wall