There is a standard XSS exploitation technique where one can use javascript keyword in <a href=""> to execute javascript code. Example:

<a href="javascript:alert(42);">please clickme</a>

Let's us consider PHP code which uses htmlspecialchars with combination of a prefix check, where the URL must always start with https://. Is there any way to exploit it in modern browsers like firefox, chrome?

// PHP 7
$url = htmlspecialchars($_GET["url"] ?? "", ENT_QUOTES);
$text = htmlspecialchars($_GET["text"] ?? "", ENT_QUOTES);
if ((substr($url, 0, 8) !== "https://")) {
    $url = "https://" . $url;
<a href="<?= $url; >"><?= $text; ></a>

I know that there is a open redirect vulnerability. I tried things like https://@javascript://://alert(); but it seems that google chrome blocks it (medium.com 2017: Say goodbye to URLs with embedded credentials). [This question is not about securing that code - this question is solely about exploiting.]

Here are more examples from the past:

  • probably a browser bug is required to make it exploitable May 1 '20 at 21:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.