Why don’t browsers throw an error when any other word is used in place of ‘javascript’ in the value of onclick?

The string value of an “onclick” attribute is taken to be simple JavaScript code. JavaScript includes provisions for labeled statements, so that code is a return statement with the label “jamoscript”. In other words, this:

jamoscript: return confirm("Do you really want to hurt me?");

is perfectly legal JavaScript. Labels aren’t used much, so they’re unfamiliar.

The only context in which the “javascript:” prefix matters is when a URL is expected, as is the case with the “href” attribute of <a> tags.

Leave a Comment

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)