Client-side scripting

Not to be confused with Cross-site scripting.

Client-side scripting generally refers to the class of computer programs on the web that are executed client-side, by the user's web browser, instead of server-side (on the web server). This type of computer programming is an important part of the Dynamic HTML (DHTML) concept, enabling web pages to be scripted; that is, to have different and changing content depending on user input, environmental conditions (such as the time of day), or other variables.

Client-side scripts are often embedded within an HTML or XHTML document (hence known as an "embedded script"), but they may also be contained in a separate file, to which the document (or documents) that use it make reference (hence known as an "external script"). Upon request, the necessary files are sent to the user's computer by the web server (or servers) on which they reside. The user's web browser executes the script, then displays the document, including any visible output from the script. Client-side scripts may also contain instructions for the browser to follow in response to certain user actions, (e.g., clicking a button). Often, these instructions can be followed without further communication with the server.

By viewing the file that contains the script, users may be able to see its source code. Many web authors learn how to write client-side scripts partly by examining the source code for other authors' scripts.

In contrast, server-side scripts, written in languages such as PHP, ASP.NET, Java, Adobe ColdFusion, Perl, Ruby, Go, Python, and server-side JavaScript, are executed by the web server when the user requests a document. They produce output in a format understandable by web browsers (usually HTML), which is then sent to the user's computer. The user cannot see the script's source code (unless the author publishes the code separately), and may not even be aware that a script was executed. Documents produced by server-side scripts may, in turn, contain client-side scripts.

Server-side scripts require that their language's interpreter be installed on the server, and produce the same output regardless of the client's browser, operating system, or other system details. Client-side scripts do not require additional software on the server (making them popular with authors who lack administrative access to their servers); however, they do require that the user's web browser understands the scripting language in which they are written. It is therefore impractical for an author to write scripts in a language that is not supported by popular web browsers.

Due to security restrictions, client-side scripts may not be allowed to access the user's computer beyond the web browser application. Techniques like ActiveX controls can be used to sidestep this restriction.

Client-side scripting is not inherently unsafe. Users, though, are encouraged to always keep their web browsers up-to-date to avoid exposing their computer and data to new vulnerabilities.

The latest group of web browsers and web pages tend to employ a heavy amount of client-side scripting, accounting for an improved user interface in which the user does not experience the unfriendly "refreshing" of the web page, but instead sees perhaps an animated GIF file indicating that the request occurred and the page will be updated shortly. Ajax is an important addition to the JavaScript language, allowing web developers to communicate with the web server in the background without requiring a completely new version of the page to be requested and rendered. This leads to a much improved user experience in general.

Unfortunately, even languages that are supported by a wide variety of browsers may not be implemented in precisely the same way across all browsers and operating systems. Authors are well-advised to review the behaviour of their client-side scripts on a variety of platforms before they put them into use.

Client-controlled or Client-generated Client-Side scripting

Besides scripts created by the programmer(s) of the site, sent from the server to the client to be executed by the client, out-sourcing page-rendering work to the client, there is another class of client-side scripting that is under the control of the client or its user respectively. This is used to automate repetitive surfing-tasks, like form filling or Web testing. It is not used to render a single page but to make the browser accomplish different tasks beginning from filling a login-form up to testing complete websites or automated gathering of the latest data from numerous websites. An especially easy to learn and use example is iMacros. Another increasingly popular use is the augmented browsing that gives the user more control over how web content is displayed to him. See Greasemonkey for a popular extension.

List of Client-Side Scripting languages

• JavaScript
• ActionScript (used to create animated interactive web applications for Adobe Flash Player using Adobe Flash Pro)
• Dart
• VBScript (NOTE: VBScript can also be used as Server-side so that processing is done on the server.)
• Typescript
• Python
• ajax