The HTML <script>
element is used to embed or reference executable code; this is typically used to embed or refer to JavaScript code. The <script> element can also be used with other languages, such as WebGL's GLSL shader programming language.
Content categories | Metadata content, Flow content, Phrasing content. |
---|---|
Permitted content | Dynamic script such as text/javascript . |
Tag omission | None, both the starting and ending tag are mandatory. |
Permitted parents | Any element that accepts metadata content, or any element that accepts phrasing content. |
Permitted ARIA roles | None |
DOM interface | HTMLScriptElement |
Attributes
This element includes the global attributes.
async
HTML5- This is a Boolean attribute indicating that the browser should, if possible, execute the script asynchronously.
This attribute must not be used if the src
attribute is absent (i.e. for inline scripts). If it is included in this case it will have no effect.
-
Dynamically inserted scripts execute asynchronously by default, so to turn on synchronous execution (i.e. scripts execute in the order they were inserted) set
async=false
. - See Browser compatibility for notes on browser support. See also Async scripts for asm.js.
crossorigin
- Normal
script
elements pass minimal information to thewindow.onerror
for scripts which do not pass the standard CORS checks. To allow error logging for sites which use a separate domain for static media, use this attribute. See CORS settings attributes for a more descriptive explanation of its valid arguments. defer
- This Boolean attribute is set to indicate to a browser that the script is meant to be executed after the document has been parsed, but before firing
DOMContentLoaded
.
This attribute must not be used if the src
attribute is absent (i.e. for inline scripts), in this case it would have no effect.
- To achieve a similar effect for dynamically inserted scripts use
async=false
instead. Scripts with thedefer
attribute will execute in the order in which they appear in the document. integrity
- This attribute contains inline metadata that a user agent can use to verify that a fetched resource has been delivered free of unexpected manipulation. See Subresource Integrity.
nomodule
- This Boolean attribute is set to indicate that the script should not be executed in browsers that support ES6 modules — in effect, this can be used to serve fallback scripts to older browsers that do not support modular JavaScript code.
This is an experimental API and should not be used in production code.
nonce
- A cryptographic nonce (number used once) to whitelist inline scripts in a script-src Content-Security-Policy. The server must generate a unique nonce value each time it transmits a policy. It is critical to provide a nonce that cannot be guessed as bypassing a resource's policy is otherwise trivial.
src
- This attribute specifies the URI of an external script; this can be used as an alternative to embedding a script directly within a document.
If a script
element has a src
attribute specified, it should not have a script embedded inside its tags.
text
- Like the
textContent
attribute, this attribute sets the text content of the element. Unlike thetextContent
attribute, however, this attribute is evaluated as executable code after the node is inserted into the DOM. type
-
This attribute indicates the type of script represented. The value of this attribute will be in one of the following categories:
- Omitted or a JavaScript MIME type: For HTML5-compliant browsers this indicates the script is JavaScript. HTML5 specification urges authors to omit the attribute rather than provide a redundant MIME type. In earlier browsers, this identified the scripting language of the embedded or imported (via the
src
attribute) code. JavaScript MIME types are listed in the specification. module
: HTML5 For HTML5-compliant browsers the code is treated as a JavaScript module. The processing of the script contents is not affected by thecharset
anddefer
attributes. For information on usingmodule
, see ES6 in Depth: Modules.- Any other value: The embedded content is treated as a data block which won't be processed by the browser. Developers must use a valid MIME type that is not a JavaScript MIME type to denote data blocks. The
src
attribute will be ignored.
Note: in Firefox you could specify the version of JavaScript contained in a
<script>
element by including a non-standardversion
parameter inside thetype
attribute — for exampletype="application/javascript;version=1.8"
. This has been removed in Firefox 59 (see bug 1428745). - Omitted or a JavaScript MIME type: For HTML5-compliant browsers this indicates the script is JavaScript. HTML5 specification urges authors to omit the attribute rather than provide a redundant MIME type. In earlier browsers, this identified the scripting language of the embedded or imported (via the
Deprecated attributes
language
- Like the
type
attribute, this attribute identifies the scripting language in use. Unlike thetype
attribute, however, this attribute’s possible values were never standardized. Thetype
attribute should be used instead.
Notes
Scripts without async
or defer
attributes, as well as inline scripts, are fetched and executed immediately, before the browser continues to parse the page.
The script should be served with the text/javascript
MIME type, but browsers are lenient and only block them if the script is served with an image type (image/*
); a video type (video/*
); an audio (audio/*
) type; or text/csv
. If the script is blocked, an error
is sent to the element, if not a load
event is sent.
Example
<!-- HTML4 and (x)HTML --> <script type="text/javascript" src="javascript.js"></script> <!-- HTML5 --> <script src="javascript.js"></script>
Specifications
Specification | Status | Comments |
---|---|---|
HTML Living Standard The definition of '<script>' in that specification. |
Living Standard | Adds the module type |
HTML5 The definition of '<script>' in that specification. |
Recommendation | |
HTML 4.01 Specification The definition of '<script>' in that specification. |
Recommendation | |
Subresource Integrity The definition of '<script>' in that specification. |
Recommendation | Adds the integrity attribute. |
Browser compatibility
The information shown below has been pulled from MDN's Github (https://github.com/mdn/browser-compat-data)
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
Feature | Chrome | Edge | Firefox | Internet Explorer | Opera | Safari |
---|---|---|---|---|---|---|
Basic support | 1 | Yes | 11 | Yes | Yes | Yes |
async | 1 | Yes | 1 | Yes | Yes | Yes |
crossorigin | 30 | Yes | 13 | No | 12 | Yes2 |
defer | Yes | Yes | 3.53 | 104 | No | Yes |
integrity | 45 | No | 43 | No | ? | No5 |
language | 1 | Yes | 1 | Yes | Yes | Yes |
nomodule | Yes | No | 60 55 — 606 | No | No | No |
src | 1 | Yes | 1 | Yes | Yes | Yes |
text | 1 | Yes | 1 | Yes | Yes | Yes |
type | 1 | Yes | 1 | Yes | Yes | Yes |
type.module | 61 | 16 | 60 54 — 607 | No | 48 | 10.1 |
type : The version parameter of the type attribute | No | No | Yes — 59 | No | No | No |
Feature | Android webview | Chrome for Android | Edge mobile | Firefox for Android | Opera Android | iOS Safari | Samsung Internet |
---|---|---|---|---|---|---|---|
Basic support | Yes | Yes | Yes | 4 | Yes | Yes | Yes |
async | Yes | Yes | Yes | 4 | Yes | Yes | Yes |
crossorigin | Yes | Yes | ? | 14 | ? | ? | Yes |
defer | Yes | Yes | Yes | 4 | ? | Yes | Yes |
integrity | 45 | 45 | No | 43 | ? | No | 5.0 |
language | Yes | Yes | Yes | 4 | Yes | Yes | Yes |
nomodule | Yes | Yes | No | 60 55 — 606 | ? | No | Yes |
src | Yes | Yes | Yes | 4 | Yes | Yes | Yes |
text | Yes | Yes | Yes | 4 | Yes | Yes | Yes |
type | Yes | Yes | Yes | 4 | Yes | Yes | Yes |
type.module | 61 | 61 | 16 | 60 54 — 607 | 48 | 10.3 | No |
type : The version parameter of the type attribute | No | No | No | Yes — 59 | No | No | No |
1. Starting in Firefox 4, inserting <script> elements that have been created by calling document.createElement("script")
no longer enforces execution in insertion order. This change lets Firefox properly abide by the specification. To make script-inserted external scripts execute in their insertion order, set .async=false
on them.
2. The crossorigin
attribute was implemented in WebKit in WebKit bug 81438.
3. Since Firefox 3.6, the defer
attribute is ignored on scripts that don't have the src
attribute. However, in Firefox 3.5 even inline scripts are deferred if the defer
attribute is set.
4. In versions prior to Internet Explorer 10, it implemented defer
by a proprietary specification. Since version 10 it conforms to the W3C specification.
5. WebKit bug 148363 tracks WebKit implementation of Subresource Integrity (which includes the integrity
attribute).
6. From version 55 until version 60 (exclusive): this feature is behind the dom.moduleScripts.enabled
preference (needs to be set to true
). To change preferences in Firefox, visit about:config.
7. From version 54 until version 60 (exclusive): this feature is behind the dom.moduleScripts.enabled
preference (needs to be set to true
). To change preferences in Firefox, visit about:config.
Compatibility notes
In older browsers that don't support the async
attribute, parser-inserted scripts block the parser; script-inserted scripts execute asynchronously in IE and WebKit, but synchronously in Opera and pre-4 Firefox. In Firefox 4, the async
DOM property defaults to true
for script-created scripts, so the default behaviour matches the behaviour of IE and WebKit.
To request script-inserted external scripts be executed in the insertion order in browsers where the document.createElement("script").async
evaluates to true
(such as Firefox 4), set .async=false
on the scripts you want to maintain order.
Never call document.write()
from an async script. In Firefox 3.6, calling document.write()
has an unpredictable effect. In Firefox 4, calling document.write()
from an async script has no effect (other than printing a warning to the error console).