"I don’t know why this simple attack is allowed to work … browsers should not allow the href to be modified on a link with the onClick handler." It is often ne

"I don’t know why this simple attack is allowed to work … browsers should not allow the href to be modified on a link with the onClick handler." It is often necessary to attach click handlers to anchor tags. For example, let's say you have a link to an image, but when a user clicks on that link, you don't want to navigate to the raw image - you want to open it in a shadowbox. But if someone right clicks and copies the links URL, that will take them to the raw image. In terms of browsers "allowing" this to happen - anything beyond the ham-fisted approach of just disallowing click handlers on all anchor tags would be prohibitively complicated. It is something worth being aware of though - just because that link says it's taking you to Google doesn't mean it won't take you somewhere less savory!