Javascript - prevent URL from being unescaped

Question

This might sound like a very silly question but I ran into something and have no clue as to what to do at the moment. Surprisingly, I could not find anything via Google (I did it wrong, for sure).

For example:

javascript:alert('%62%6D%69');

outputs bmi . How to make it output %62%6D%69 ?

Thanks for helping me out here.

Answer 1

Just try this in your browser url javascript:alert("%2562%256D%2569") . Escaped it again.

Programmatically,

var x = escape("%62%6D%69");
location.href = "javascript:alert('"+x+"')";

or

location.href = encodeURI("javascript:alert('%62%6D%69')")

or inception mode

location.href = encodeURI("javascript:alert('%62%6D%69'); location.href = encodeURI(\"javascript:alert('%62%6D%69')\")")

Hope this helps!