In an app I am testing they allow to input a domain name, store it, and when they print it on the browser they concatenate "http://" at the beginning of the domain. So, if you input "google.com", then they create a link like this:
<a href="http://google.com"> google </a>
So, if you try to input "javascript:alert(1)", the link would be
<a href="http://javascript:alert(1)"> google </a>
If they would not concatenate the "http://" at the beginning, that javascript would execute when the link is clicked. So, we can be sure that that is 100% safe from XSS because they always concatenate the "http://" at the beginning?
Thanks! Note: If you input quotes, they encode them as \u003ca