I have an anchor that has href attribute populated by my input. I am trying to input javascript, but it always renders it useless since it always appears between double quotes.

So far, I have tried many inputs including:

" onclick=alert(1)

But, everytime the input comes inside double quotes and for javascript:alert(1) it is preceded by unsafe:. Is there anyway to bypass this?

  • This is a pure programming question. it is off topic on Security SE. I suggest to close it.
    – mentallurg
    May 1, 2022 at 19:11

1 Answer 1


make sure the X-xss-protection header is off and try your payload in another browser like Firefox

  • 1
    You forgot to specify that it's a header you need to disable (and how on earth would you do without access to the server!?) and what does the browser have to do anything here? Mar 18, 2023 at 10:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .