Question

i am just trying to create a link which execute some JavaScript in stead to redirect the user to a particular page

I tried the following but it doesn t work

<a href="#" onclick="javascript:location.replace('http://http://stackoverflow.com/questions/ask');">www.google.com</a><br />


<a href="javascript:location.replace('http://stackoverflow.com/questions/ask');">www.google.com</a>

I am not trying to do anything illegal whit the redirect, just an exercise for a university module (Internet Security)

Thanks

Answer 1

Your second link works. First one doesn’t. As was said earlier, onclick doesn’t require ‘javascript:’ as it’s implied.

Also – your first link has an incorrect url: http://http://stac... – notice two http://

And finally, as you may realize, you can technically spoof a link simply by mismatching the href and text properties without javascript:

<a href="http://stackoverflow.com" title="www.google.com">www.google.com</a>

Obviously hovering over the link would reveal the url to saavy users or those not paying attention, but thought I’d include it for example’s sake…

The most likely to fool people is:

<a href="http://www.google.com" onclick="location.replace('http://www.stackoverflow.com/');return false;">www.google.com</a>

Hovering shows google in status bar. Only way to detect this is to inspect html.

It’s things like this that make Firefox + NoScript so valuable 🙂