Defenses: <script> stripped, event handlers stripped, javascript: blocked (case-insensitive). Input is placed into an <a href>.
Provide a URL. The server blocks script tags, event handlers, and javascript:. Your URL is placed into a clickable link.
CONCEPT: URL Scheme Bypass via Entity Encoding
When user input is placed into an HTML attribute like href="...", the browser performs HTML entity decoding on the attribute value before interpreting it as a URL. This means j (the HTML entity for "j") becomes "j" in the browser's URL parser. A server-side filter that checks the raw string for javascript: won't find a match if the attacker uses javascript: or javascript:. The browser, however, decodes the entity and sees javascript: — executing the code when the link is clicked. This is a fundamental mismatch between server-side string matching and browser-side HTML parsing. Defense: decode all entities server-side before checking, or parse the URL properly and allowlist only http: and https: schemes.
Enter a URL to create a link.