Java, JavaScript, and ActiveX components are often overlooked as potential threats to a Web site. These are client-side scripts and components, which run on the computer of a visitor to your site. Because they run on a user's computer, any problems will generally affect them rather than the Web site itself. However, the effect of an erroneous or malicious script, applet, or component can be just as devastating to your site. If a client's computer locks up when one of these loads on their computer every time she visits your site it ultimately will have the same effect as your Web server going down: No one will be able to use your site.

As we show in the sections that follow, a number of problems may result from Java applets, ActiveX components, or client-side scripts such as JavaScript. Not all of these problems affect the client, and they may provide a means of attacking your site. Ultimately, however, the way to avoid such problems involves controlling which programs are made available on your site and being careful about what is included in the content.