I have a piece of code that allows for


BB-Code and replaces it with

<a href="someurl">someurl</a>

It takes two precautions to prevent XSS.

  1. It replaces <, > and " using a simple str_replace.
  2. Uses a regex to detect javascript: and data: protocol handlers.

Since browsers decode the attribute value before further interpreting it, you can get around the regex check by encoding the URL using [url]&#x6A ... [/url].

So I get:

<a href="javascript:alert(1)">javascript:alert(1)</a>

Long story short: I want more than a steenkin attribute tage (who would click a link looking like that?!)

Can I somehow encode my ", <, etc. so it won't be replaced by the str_replace but still be interpreted in the context of HTML?

  • I think this question belong to SO Jan 15, 2013 at 14:54
  • I agree this should be on StackOverflow since you're asking how to code something in a particularl language. I flagged it as off-topic, hoping a moderator can migrate it. Jan 15, 2013 at 15:48
  • 4
    It is related to security, er4z0r asks how to bypass the described filter to run javascript code.
    – Dinu
    Jan 15, 2013 at 15:54
  • @DinuSmădu - Asking how to encode it is a programming question not a security question.
    – Ramhound
    Jan 16, 2013 at 17:40
  • 2
    @Ramhound Maybe the question is not well formulated. I understood that the question is how to encode in order to bypass the filter.
    – Dinu
    Jan 16, 2013 at 19:56

2 Answers 2


A blacklist approach will always be flawed. For example, under internet explorer you can use the vbscript: URI to execute vbscript code. There are also ways of encoding javascript: to bypass this check. There have been a large number of itunes exploits that rely upon the itunes: URI to exploit itunes from the browser. This is just two examples, but really there could be any URI handler registered on a target system.

I would run this though a htmlencode routine to encode all quote marks and angle brackets. The benefit of this is that the URL could legitimately contain quote marks without being damaged. This is because the browser will automatically perform an html-decode of all attribute values as they are loaded. Then I would enforce that the first 4 characters are http. If the string does not start with http:// or https:// then prepend http://

  • Thanks Rock. I think you misread my question. I already do the HTML encoding to get around the blacklist (and of course I know that whitelisting is the way to got). What I cannot do using HTML-Encoding is breakt out of the context of the attribute value because if I encode the whole string with html encoding this will not work to add new attributes to the href tag or close the tag since HTML does not decode stuff like &#x6A into characters outside the context of the attribute value.
    – er4z0r
    Jan 16, 2013 at 10:37
  • I did not know about the vbscript: handler. Do you know about a good list of handlers that one could try? I did not find the information with OWASP
    – er4z0r
    Jan 16, 2013 at 10:44
  • 1
    It depends on what is installed on the host. Registered protocol handlers are located in the Windows registry under: HKEY_CLASSES_ROOT\PROTOCOLS\Handler. Handler examples: irc, geo, mailto, magnet, mms, news, nntp, sip, sms, smsto, ssh, tel, urn, webcal, xmpp. Jan 16, 2013 at 11:04
  • 1
    @er4z0r use a whitelist approach, a blacklist will always fail. You cannot possibly know every bullshit URI, I could just come up with one right now on my own machine.
    – rook
    Jan 16, 2013 at 15:34
  • @Rock: Again. This is not about DEFENSE. It is about OFFENSE. I know perfectly well that blacklisting sucks. I want to know if there is a way to gain more than just execution in the context of href
    – er4z0r
    Jan 21, 2013 at 23:45

You can trick someone into clicking on a link like this though:

Javascript: an_open_source_clientside_scripting_language_commonly_implemented_as_part_of_a_web_browser_in_order_to_create_enhanced_user_interfaces_and_dynamic_websites(); function an_open_source_clientside_scripting_language_commonly_implemented_as_part_of_a_web_browser_in_order_to_create_enhanced_user_interfaces_and_dynamic_websites() {alert(1)}

You could try UTF7 encoding evasion but is no longer supported in modern browsers.

  • Thanks for your tips. The idea to trick the user into clicking the link like this is ver creative. I like :) The utf-7 approach won't work for me since the target correctly sets the charset to utf-8
    – er4z0r
    Jan 16, 2013 at 10:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .