Server-Side JavaScript, 1996

Netscape ran JavaScript on the server a decade before Node, marked off with a SERVER tag right inside the page.

In 2026: Dead, with a sting. LiveWire compiled the SERVER blocks on Netscape Enterprise Server and sent only their output to the browser. A modern browser has no server step, so it treats SERVER as an unknown element and prints the code inside as page text, which is precisely the leak that exposed database passwords on every misconfigured LiveWire site.

Where it came from: Netscape LiveWire server-side JavaScript, Netscape Enterprise Server, 1996. Wikipedia ↗

<h2>Welcome</h2>

<!-- On a Netscape LiveWire server this ran and vanished, leaving output -->
<server>
  var visits = project.lock() ? ++project.hits : 0;
  project.unlock();
  write("You are visitor number " + visits + ".");
  // database.SQLTable("SELECT * FROM users WHERE pass = '" + secret + "'");
</server>

<p>In a browser with no server, the code above leaks out as plain text.
   That is exactly how LiveWire sites spilled their secrets.</p>