Why is the use of TAB (%09) characters in the middle a 'JavaScript:' URL valid?security.stackexchange.com1 pointelsadek6 years ago