In an app I am testing they allow to input a domain name, store it, and when they print it on the browser they concatenate "http://" at the beginning of the domain. So, if you input "google.com", then they create a link like this:

<a href="http://google.com"> google </a>

So, if you try to input "javascript:alert(1)", the link would be

<a href="http://javascript:alert(1)"> google </a>

If they would not concatenate the "http://" at the beginning, that javascript would execute when the link is clicked. So, we can be sure that that is 100% safe from XSS because they always concatenate the "http://" at the beginning?

Thanks! Note: If you input quotes, they encode them as \u003ca

  • In this case that would not work because they encode quotes as \u003ca
    – Sfp
    Jun 11, 2019 at 22:11
  • What if I encode " with %22 ?
    – Rahul
    Jun 12, 2019 at 12:25
  • @Rahul I thnik it would just be displayed as " but not executed
    – Cyberduck
    Jun 12, 2019 at 13:10

1 Answer 1


I don't think this method would be safe from XSS. This type of vulnerability sounds like a typical case of Reflected XSS. If you would escape the href tag with some " you can enter a XSS code. Your link would look like this if you enter foo.at"><script>alert(81)</script>"page=1 into the input field ->

<a href="http://foo.at"><script>alert(81)</script>"page=1">google </a>

I would suggest to use a filter on the website which converts all special chars to an other format. Like htmlspecialchars in php.

  • with this note Note: If you input quotes, they encode them as \u003ca, I meant you cannot do that specifically
    – Sfp
    Jun 11, 2019 at 22:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .