There are claims within this thread suggesting that the "javascript:" prefix is considered a remnant from the past, hinting that it may be intentionally designed to be handled by browsers for backward compatibility. Is there concrete evidence supporting this theory? Has anyone delved into the source code to confirm?
<span onclick="javascript:alert(42)">Test</span>
To me, it appears as simply:
javascript:
alert(42);
This suggests that "javascript:" acts purely as a label and does not impact functionality. This alternative approach also demonstrates the same concept:
<span onclick="foobar:alert(42)">Test</span>
Update:
Upon conducting a small experiment, it has been discovered that while "javascript:" is treated uniquely by IE, other major browsers like Firefox, Safari, Opera, and Chrome do not exhibit the same behavior:
<span onclick="javascript:while (true) { alert('once'); break javascript; }">Test</span>
In non-IE browsers, the script will display "once" once and exit the loop. However, in IE, an error message stating "Label not found" is encountered. Conversely, the following script functions correctly across all browsers:
<span onclick="foo:while (true) { alert('once'); break foo; }">Test</span>
Update 2:
It has come to light that the referenced link mentioned in a previous response touches upon a similar topic.