This question already has an answer here:
- XSS with URL encoding 2 answers
The tag works like this:
<a ref="http://googl.com%22 onclick=alert(124)">http://google.com" onclick=alert(124)</a>
Here, the double quote I put is turned into
%22. Is there a way to overcome it?