Skip to content
CodeLifter
Search/ Browse prompts
CodeLifter Forum
SearchAsk a question

Is it safe to paste a script from an old tutorial site?

Staff answerWritten by CodeLifter editors · Script Shelf2 repliesupdated

Short answer

LinkMarkdown

Reading it is safe, pasting it unchanged is a manageable risk, and linking to the copy on the old site is the real danger. Copy the code into your own file, read every line for what it loads and writes into the page, check the licence, and never point a script tag at a host you do not control.

Written by CodeLifter editors · Staff, CodeLifter ·
CiteCodeLifter Forum, "Is it safe to paste a script from an old tutorial site?", https://codelifter.com/forum/posts/is-it-safe-to-paste-a-script-from-an-old-tutorial-site/, accessed 2026-11-12.
  1. Staff, CodeLifter ·

    The three questions to ask of any old snippet

    An old tutorial script can hurt you in three different ways, and each has its own check.

    1. What does it load? Any <script src>, <link href>, image or fetch() pointing at another host makes that host part of your page.
    2. What does it write into the page? Code that turns strings into HTML or code can run whatever ends up in those strings.
    3. What are you allowed to do with it? Code with no licence is still somebody's copyright.

    A script can pass one question and fail another. A clean ten-line function with no licence is safe to run and not yours to republish.

    Old tutorials often say "add this line to your page" with a src on the tutorial's own domain. Do not. Whoever controls that host controls what runs on your page. MDN's Subresource Integrity page describes the risk directly: if an attacker gains control of the third-party host, they can inject arbitrary content into its files or replace them completely. Old hobby domains change hands when they lapse, so the person serving that file next year may not be the person who wrote the tutorial.

    Do this instead:

    1. Open the script URL in your browser and save the file into your project, for example js/legacy-quote.js.
    2. Read it (see the next section).
    3. Load your copy: <script src="/js/legacy-quote.js"></script>.

    If you must load a file from someone else's server, for example a library on a CDN, pin it with an integrity hash and crossorigin="anonymous". MDN gives an OpenSSL command that produces the hash:

    cat legacy-quote.js | openssl dgst -sha384 -binary | openssl base64 -A

    Prefix the output with sha384-. If the file on the server changes by a single byte, the browser refuses to run it and reports a network error. MDN adds that the server has to send CORS headers for this to work, so a plain personal host may not support it at all; that is one more reason to keep a local copy.

    Very old tutorials also link scripts over http://. On an HTTPS page that request is blocked as mixed content, so the script silently never loads. Changing the URL to https:// is not a fix if the copy behind it is not the one you read.

    Read it for the risky lines

    Search the file for these, then read the surrounding code:

    What you find Why it matters What to do
    innerHTML, outerHTML, insertAdjacentHTML Parses a string as HTML, so any markup in it becomes live Use textContent for text, createElement for structure
    document.write() MDN calls it an injection sink and a possible XSS vector, and it is deprecated Rewrite with DOM methods
    eval(), new Function(), setTimeout("string") Runs a string as code Pass a function instead
    A URL to another host That host is now part of your page Copy the file locally, or pin it with SRI
    http:// Blocked on HTTPS pages, or fetched without encryption Use a local copy
    document.cookie, form values sent anywhere The snippet touches visitor data Find out where it goes before you keep it

    The innerHTML thread covers the same pattern when it comes from an assistant rather than a tutorial, and the fix is the same.

    Check the licence before you ship

    Many old tutorial pages never stated a licence. GitHub's guide to licensing a repository states the default plainly: without a licence, no one may reproduce, distribute or create derivative works from the work. Some old sites had terms that allowed reuse with a credit comment; if so, keep the comment and note where you found the terms. If you cannot find any terms, treat the snippet as a description of a technique and write your own version. Snippet licensing goes through Stack Overflow, MDN and GitHub cases in more detail.

    Whatever you keep, write down where it came from: the URL, the date you copied it, what you changed and what licence applied. The provenance record thread lists the fields.

    Or skip the old copy

    For the classic jobs (go back, random quote, image popup, slideshow, draggable box, mouse position), the Script Shelf has MIT-licensed rewrites with their origin stated, so the licence question is already answered. For anything else, ask an assistant for the behaviour and then apply the same three questions to what it gives you. Generated code can repeat the same old patterns, and whether old scripts still run at all is a separate check worth doing too.

    0
    ReplyLink

Plain text or simple Markdown. Links are nofollow. Your email is never shown.

  1. CodeLifter editorsStaffStaff, CodeLifter ·

    Will a Content Security Policy block an old pasted script? Very likely, and that is a good thing to find out on purpose. MDN's CSP guide says that if a policy has a default-src or script-src directive, inline JavaScript is not allowed to run unless extra measures are taken. That covers code inside a <script> element in the page, inline event handler attributes such as onclick or onerror, and javascript: URLs, which are three of the most common patterns in old tutorials. The same applies to eval() and similar APIs, which MDN lists as including the Function() constructor and string arguments to setTimeout() and setInterval(). The 'unsafe-inline' and 'unsafe-eval' keywords switch the protection back off, and MDN tells developers to avoid both, because inline JavaScript is one of the most common XSS vectors. The practical path for an old snippet is the one in the opening post: move it into your own .js file, replace each onclick="..." attribute with addEventListener, and remove any string evaluation. Then a policy such as script-src 'self' lets your copy run and blocks the rest. If a script only works with 'unsafe-inline', treat that as a list of lines still to rewrite.

    0
    ReplyLink
  2. CodeLifter editorsStaffStaff, CodeLifter ·

    Can a linter find the risky lines in an old script? It can find several of them, quickly. ESLint has core rules for the patterns in the table above. no-eval reports every use of eval(), including indirect calls such as (0, eval)("...") unless you set its allowIndirect option. no-implied-eval reports setTimeout() and setInterval() called with a string as the first argument, and execScript(), which was Internet Explorer only; ESLint's page explains that passing a function is safer and faster. Both are worth turning on for any folder of copied code:

    // eslint.config.mjs
export default [{ files: ["js/legacy-*.js"], rules: { "no-eval": "error", "no-implied-eval": "error" } }];

    Run npx eslint js/ and fix what it reports. For innerHTML and insertAdjacentHTML, add Mozilla's no-unsanitized plugin, set up in the innerHTML thread. A linter reads code, not intent, so it will not tell you where fetch() sends a cookie or which host a src points at. Keep the manual search for other domains and http://, and read those lines yourself.

    0
    ReplyLink
CodeLifter

Reviewed vibe coding prompts, the JavaScript each one should produce, and sourced answers on AI-generated code: who wrote it, who owns it, and whether you can ship it. Free since 1999.

Browse the Prompt Shelf

Popular topics

© 1999 to 2026 CodeLifter

Independent. No ties to any software vendor.
Code MIT Text CC-BY-4.0 Back to top