A visitor-provided URL is untrusted data until your application validates and safely handles it. HTML escaping alone does not decide whether a destination is safe. The important question is always where the link leads and whether the person reading the page can predict it.
What You Need to Know
Applications should allow appropriate URL schemes and handle redirects carefully. Never let user input become a javascript: link merely because it fits inside an href attribute.
Example: See It in Action
Here is a simple example to experiment with. Type it, save the file, and check what the browser displays.
This is a short HTML fragment. To try it as a webpage, put it inside the body element of a complete HTML document.
<a href="/trusted-information.html">Read the safety rules</a>
<p>Validate user-provided destinations before inserting them.</p>
<p>Never copy an untrusted JavaScript URL into href.</p>Let’s Understand the Example
- An a element becomes a working link when it has an href. Its visible text should tell readers where they will go.
- A p groups a paragraph of related text. Start another paragraph for a new thought.
- Href contains the destination of a link. A value starting with # points to an id on the same page.
The first example link points to /trusted-information.html. Check whether that destination exists relative to the document. A link changes where readers go; it does not perform an action such as saving a form.
What Should You See?
You should see a link named “Read the safety rules”. Selecting it leads to /trusted-information.html when that destination exists. Try it with the mouse and the keyboard.
Imagine this link is read out of context. Would its text still explain the destination? Rename unclear links before trying to make them look nicer with CSS.
Try It Yourself
- List the URL schemes your site actually needs before accepting submitted links.
- Save your changes, open or refresh the page, and compare the result with the original example.
- Tell a friend what your change did. If you are not sure, undo it, refresh the page, and compare.
Common Beginner Mistakes
- Assuming href content is safe just because it is inside quotation marks.
- Avoid dead links, empty href values and clickable-looking text without a real destination.
Key Takeaways
- A visitor-provided URL is untrusted data until your application validates and safely handles it.
- An a element becomes a working link when it has an href. Its visible text should tell readers where they will go.
- Applications should allow appropriate URL schemes and handle redirects carefully. Never let user input become a javascript: link merely because it fits inside an href attribute.