I am new to XSS attacks. Recently, I was doing a project and found that one of my input field (website) is vulnerable to XSS attack. The value in website field is inserted into a href of an anchor tag which causes the XSS attack.

In order to check for various ways in which XSS attack can be performed, I referred a Github document where I found the below code,


When the above code is inserted into the input field, the anchor tag becomes as follows:

<a target="_blank" rel="noopener" href="\j\av\a\s\cr\i\pt\:\a\l\ert\(1\)">Sample Code</a>

On clicking the above link, an alert box pops up displaying 1

How is the above code parsed and run by the browser when the user clicks on it? I have read about escape sequences, but the above escape characters puts me in dilemma.

  • 1
    An escape character informs the parser to skip the next character while checking for special 'control' characters. An example of a special character, in case of a quoted string, would be the \ or for example the ".
    – Jacco
    Commented Jul 6, 2018 at 7:30
  • Can you either provide a larger chunk of code or more information on your browsers? I used Edge, FireFox and Chrome and I couldn't get your code to execute as described. Commented Jul 6, 2018 at 12:29

1 Answer 1


As @Jacco mentioned in his comment, the test snippet you used uses escape sequences.
In this situation, the backslash (\) is the escape character. When a backslash is encountered, it means "the next character may have special meaning, if it does, use that special meaning instead".
However, not all backslash escape sequences are valid. In those cases, the next character is used as-is. For example, \j has no special meaning, so it is interpreted as a plain j instead. However, \n (newlines), \r (carriage return), \v (vertical tab), and \t (horizontal tab) do have special meaning. This is why you won't see backslashes before those characters in your test snippet.

In your case, I don't even think the backslashes are necessary. They're merely there to attempt to circumvent any pattern based matching a detection engine might employ. I imagine it wouldn't fool too many engines though, as it's a pretty common tactic and stands out like a sore thumb.

As for how the attack works, when a browser attempts to visit a URL with a JavaScript scheme (i.e. a URL starting with javascript:), it interprets everything after it as JavaScript code and runs it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .