I wasn't an AOL user so it took me a few reads to get the concept. What this must mean is something like: [Joe] what's up <a href="//example.net/?username

I wasn't an AOL user so it took me a few reads to get the concept. What this must mean is something like: [Joe] what's up <a href="//example.net/?username= [Jane] nm, wbu [Joe] ">join my chess game?</a> Which could show on Jane's screen, if there is no HTML escaping at all, as: [Joe] what's up [Joe] join my chess game? (<-link) The message of Jane's would have looked like it got swallowed because it was inside the HTML tag, but so long as Jane doesn't know what's up and ignores it, clicking the link instead, the owner of example.net would see a pageload of https://example.net/?username=%0A%5BJane%5D%20nm%2C%20wbu%0A%5BJoe%5D%20%20 https://example.net/?username=%0A%5BJane%5D%20nm%2C%20wbu%0A... and thus learn that the other person is called Jane. Then again, for this to work it would already have to be on the screen of the person clicking the link, but not of the person who sent the link or there would be no point. So I feel like I'm still missing something.