Like this (it is a small dress up game):
<link rel="stylesheet" type="text/css" href="css/style.css">
<script src="js/code.js"></script>
Try using your browser's development console. It varies from browser to browser a little, but it can show you what requests the page is making when you load it and you can see whether it's requesting the files you think it's requesting and whether they're coming back as 404 errors.
In Firefox, you'd open your game's iframe in its own tab, then in that tab press-control-shift-K, then the "Network" tab of the console UI that appears. I think Chrome is similar but with control-shift-J, or possibly some other combination if you happen to be on a Mac.