Recently, I have been conducting some testing related to xss, javascript-injection, and penetration-testing on my asp.net website. I observed that modern web browsers like the latest versions of Firefox and Chrome automatically escape URLs entered into the address bar.
For example:
http://example.com/search/?q="><script>alert('hi');</script>
gets sent to my server as:
http://example.com/search/?q=%22%3e%3cscript%3ealert(%27hi%27)%3b%3c%2fscript%3e
I am curious if there is a comprehensive list available of all major web browsers that perform this automatic escaping, as well as those that do not. Additionally, I would like to know if mobile browsers also exhibit this behavior.