[RESOLVED] Javascript security alert on IE

[BillGeek]

Hi All

This is more an observation than a question...

Has anyone noticed that if you add javascript to your PHP pages, you don't get the "Security Alert" banner in IE? If you take exactly the same php file, remove the php code and save it as HTML, the banner appears.

Perhaps this topic has been raised before, though I couldn't find anything explaining the odd symptoms. Is there perhaps a documented reason for this anywhere?

[dclamp]

It is possible that IE doesn't look for javascript in files with the php extension.

[BillGeek]

I suspected that as well... Unfortunately there aren't any other browsers (that I'm aware of) that stops JS from running with a security alert. Opera, Firefox, etc... they all just run the JS.

[I_Love_My_Vans]

Now, you may be right, I am not in the mood to prove you wrong

If you open a HTML + JavaScript file locally IE will say 'hang about, I don't think I shall be executing a JavaScript like this' and displays a warning. But to view a PHP script, you have to go through a web server, aka this is not technically local and therefore your browser may apply normal restrictions.

Me

[BillGeek]

So basically, if a PHP page comes from a webserver, it is deemed as "safe"?

[penagate]

Yes — if you look in IE's security zoning settings, you should see that scripts in local files are untrusted. (I'm not certain why, but there you go.)

[I_Love_My_Vans]

It's not PHP from a webserver mind, any scripting language from a webserver has different settings to that of a local file.

[BillGeek]

Indeed. (I didn't submit my previous post... )

In the meanwhile, I have set the security settings for the "Internet" zone, and the security alert popped up.

Thread resolved.