Characters that can be inside the javascript protocol

Characters that can be inside the javascript protocol in html

Created Jan 22, 2025

Updated May 28, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<a href="java$[chr]script:test.com/" id="test"></a>

Code used after fuzz:

if(document.getElementById("test").protocol=="javascript:"){log($[i])}

Sample payloads

<a href="java0x09script:test.com/" id="test"></a>

<a href="java
script:test.com/" id="test"></a>

<a href="java0x0Dscript:test.com/" id="test"></a>