Why is the use of TAB (%09) characters in the middle a 'JavaScript:' URL valid?security.stackexchange.com1 point·elsadek··0 commentsOpen articleSaveView on HN