# Is it safe to paste a script from an old tutorial site?

Source: https://forum.codelifter.com/posts/is-it-safe-to-paste-a-script-from-an-old-tutorial-site/
Site: CodeLifter Forum, category Script Shelf
Published: 2026-10-16. Updated: 2026-10-16. Replies: 0.

## Question by CodeLifter editors (staff), 2026-10-16

Reading it is safe, pasting it unchanged is a manageable risk, and linking to the copy on the old site is the real danger. Copy the code into your own file, read every line for what it loads and writes into the page, check the licence, and never point a script tag at a host you do not control.

## The three questions to ask of any old snippet

An old tutorial script can hurt you in three different ways, and each has its own check.

1. **What does it load?** Any `<script src>`, `<link href>`, image or `fetch()` pointing at another host makes that host part of your page.
2. **What does it write into the page?** Code that turns strings into HTML or code can run whatever ends up in those strings.
3. **What are you allowed to do with it?** Code with no licence is still somebody's copyright.

A script can pass one question and fail another. A clean ten-line function with no licence is safe to run and not yours to republish.

## Never hotlink the old site

Old tutorials often say "add this line to your page" with a `src` on the tutorial's own domain. Do not. Whoever controls that host controls what runs on your page. MDN's [Subresource Integrity page](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity) describes the risk directly: if an attacker gains control of the third-party host, they can inject arbitrary content into its files or replace them completely. Old hobby domains change hands when they lapse, so the person serving that file next year may not be the person who wrote the tutorial.

Do this instead:

1. Open the script URL in your browser and save the file into your project, for example `js/legacy-quote.js`.
2. Read it (see the next section).
3. Load your copy: `<script src="/js/legacy-quote.js"></script>`.

If you must load a file from someone else's server, for example a library on a CDN, pin it with an `integrity` hash and `crossorigin="anonymous"`. MDN gives an OpenSSL command that produces the hash:

```bash
cat legacy-quote.js | openssl dgst -sha384 -binary | openssl base64 -A
```

Prefix the output with `sha384-`. If the file on the server changes by a single byte, the browser refuses to run it and reports a network error. MDN adds that the server has to send CORS headers for this to work, so a plain personal host may not support it at all; that is one more reason to keep a local copy.

Very old tutorials also link scripts over `http://`. On an HTTPS page that request is blocked as [mixed content](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Mixed_content), so the script silently never loads. Changing the URL to `https://` is not a fix if the copy behind it is not the one you read.

## Read it for the risky lines

Search the file for these, then read the surrounding code:

| What you find | Why it matters | What to do |
|---|---|---|
| `innerHTML`, `outerHTML`, `insertAdjacentHTML` | Parses a string as HTML, so any markup in it becomes live | Use `textContent` for text, `createElement` for structure |
| `document.write()` | MDN calls it an injection sink and a possible XSS vector, and it is deprecated | Rewrite with DOM methods |
| `eval()`, `new Function()`, `setTimeout("string")` | Runs a string as code | Pass a function instead |
| A URL to another host | That host is now part of your page | Copy the file locally, or pin it with SRI |
| `http://` | Blocked on HTTPS pages, or fetched without encryption | Use a local copy |
| `document.cookie`, form values sent anywhere | The snippet touches visitor data | Find out where it goes before you keep it |

The [innerHTML thread](/posts/how-do-i-stop-a-coding-assistant-from-using-innerhtml/) covers the same pattern when it comes from an assistant rather than a tutorial, and the fix is the same.

## Check the licence before you ship

Many old tutorial pages never stated a licence. GitHub's [guide to licensing a repository](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/licensing-a-repository) states the default plainly: without a licence, no one may reproduce, distribute or create derivative works from the work. Some old sites had terms that allowed reuse with a credit comment; if so, keep the comment and note where you found the terms. If you cannot find any terms, treat the snippet as a description of a technique and write your own version. [Snippet licensing](https://codelifter.com/provenance/snippet-licensing/) goes through Stack Overflow, MDN and GitHub cases in more detail.

Whatever you keep, write down where it came from: the URL, the date you copied it, what you changed and what licence applied. The [provenance record thread](/posts/what-should-a-provenance-record-for-copied-code-include/) lists the fields.

## Or skip the old copy

For the classic jobs (go back, random quote, image popup, slideshow, draggable box, mouse position), the [Script Shelf](https://codelifter.com/scripts/) has MIT-licensed rewrites with their origin stated, so the licence question is already answered. For anything else, ask an assistant for the behaviour and then apply the same three questions to what it gives you. Generated code can repeat the same old patterns, and [whether old scripts still run at all](/posts/do-old-cut-and-paste-scripts-still-work-in-current-browsers/) is a separate check worth doing too.

---
Cite as: CodeLifter Forum, "Is it safe to paste a script from an old tutorial site?", https://forum.codelifter.com/posts/is-it-safe-to-paste-a-script-from-an-old-tutorial-site/, accessed 2026-10-16.