This is where I took this example from:

<a href="<?php echo $_GET['e'];?>">Back</a>

In this code, I can do http://my_url?e=javascript:alert()

But what can I do if my code is like this:

<a href="e<?php echo $_GET['e'];?>">Back</a>

  • 1
    what are you trying to achieve here?
    – yeah_well
    Dec 2, 2020 at 13:18

2 Answers 2



If the data you inject is arbitrary and not filtered at all, you could inject "></a><script>alert('XSS')</script><a href="#

This will end up with the following DOM elements:

<a href="e"></a><script>alert('XSS')</script><a href="#">Back</a>
  • Short answer is YES, Long answer is what is your PHP script sanitizing input then what you are trying to achieve might not be displayed like you want to achieve XSS

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .