This needs to override JavaScript commands to keep it from malicious use. For example, to override alert() do this:

  (function()
  {
    var proxied = window.alert;
    window.alert = function()
    {
      // replacement code here
      // call original function:
      proxied.apply(this, arguments);
    };
  })();