no, your pretty much right if he's using an html page. If its an ocx control he could trigger an event on the page and would then run whatever javascript he wants for it. Ass far as how to do it im not exactly sure but there is info about it somewhere.