Is it safe to paste a script from an old tutorial site?

The three questions to ask of any old snippet

An old tutorial script can hurt you in three different ways, and each has its own check.

1. What does it load? Any <script src>, <link href>, image or fetch() pointing at another host makes that host part of your page.
2. What does it write into the page? Code that turns strings into HTML or code can run whatever ends up in those strings.
3. What are you allowed to do with it? Code with no licence is still somebody's copyright.

A script can pass one question and fail another. A clean ten-line function with no licence is safe to run and not yours to republish.

Never hotlink the old site

Old tutorials often say "add this line to your page" with a src on the tutorial's own domain. Do not. Whoever controls that host controls what runs on your page. MDN's Subresource Integrity page describes the risk directly: if an attacker gains control of the third-party host, they can inject arbitrary content into its files or replace them completely. Old hobby domains change hands when they lapse, so the person serving that file next year may not be the person who wrote the tutorial.

Do this instead:

1. Open the script URL in your browser and save the file into your project, for example js/legacy-quote.js.
2. Read it (see the next section).
3. Load your copy: <script src="/js/legacy-quote.js"></script>.

If you must load a file from someone else's server, for example a library on a CDN, pin it with an integrity hash and crossorigin="anonymous". MDN gives an OpenSSL command that produces the hash:

cat legacy-quote.js | openssl dgst -sha384 -binary | openssl base64 -A

Prefix the output with sha384-. If the file on the server changes by a single byte, the browser refuses to run it and reports a network error. MDN adds that the server has to send CORS headers for this to work, so a plain personal host may not support it at all; that is one more reason to keep a local copy.

Very old tutorials also link scripts over http://. On an HTTPS page that request is blocked as mixed content, so the script silently never loads. Changing the URL to https:// is not a fix if the copy behind it is not the one you read.

Read it for the risky lines

Search the file for these, then read the surrounding code:

What you find	Why it matters	What to do
innerHTML, outerHTML, insertAdjacentHTML	Parses a string as HTML, so any markup in it becomes live	Use textContent for text, createElement for structure
document.write()	MDN calls it an injection sink and a possible XSS vector, and it is deprecated	Rewrite with DOM methods
eval(), new Function(), setTimeout("string")	Runs a string as code	Pass a function instead
A URL to another host	That host is now part of your page	Copy the file locally, or pin it with SRI
http://	Blocked on HTTPS pages, or fetched without encryption	Use a local copy
document.cookie, form values sent anywhere	The snippet touches visitor data	Find out where it goes before you keep it

The innerHTML thread covers the same pattern when it comes from an assistant rather than a tutorial, and the fix is the same.

Check the licence before you ship

Many old tutorial pages never stated a licence. GitHub's guide to licensing a repository states the default plainly: without a licence, no one may reproduce, distribute or create derivative works from the work. Some old sites had terms that allowed reuse with a credit comment; if so, keep the comment and note where you found the terms. If you cannot find any terms, treat the snippet as a description of a technique and write your own version. Snippet licensing goes through Stack Overflow, MDN and GitHub cases in more detail.

Whatever you keep, write down where it came from: the URL, the date you copied it, what you changed and what licence applied. The provenance record thread lists the fields.

Or skip the old copy

For the classic jobs (go back, random quote, image popup, slideshow, draggable box, mouse position), the Script Shelf has MIT-licensed rewrites with their origin stated, so the licence question is already answered. For anything else, ask an assistant for the behaviour and then apply the same three questions to what it gives you. Generated code can repeat the same old patterns, and whether old scripts still run at all is a separate check worth doing too.