Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have seen claims that some email services mark emails with javascript as spam. But I have not seen mentioned that any sensible service would just optionally scrub any embedded javascript entirely while leaving html in place. Am I looking in the wrong place or is this feature in fact not yet implemented anywhere?

share|improve this question
up vote 3 down vote accepted

Gmail strips out any content between <script> tags before displaying the message. If an e-mail has script tags in it it doesn't mean google will automatically mark it as spam but it could be one of the things that increases the chance.

Most web mail providers and email clients will (or should) do this to prevent against xss (cross-site scripting) attacks. Read more about these here.

Therefore there's no point in sending e-mails containing JavaScript (even if it does something useful) because it will almost certainly get blocked when the message is viewed and could contribute towards it getting marked as spam.

share|improve this answer

I think Gmail is set up in such a way that javascript embedded in an email will never be executed, hence there's no need to actually remove it. I'm not entirely certain how that works but you can confirm it for yourself by embedding

<script type="text/javascript">

in an email and emailing it your gmail account - you won't see any popup dialogs when you open the email.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .