Prevent injecting JavaScript into `href` attribute on `a` tag

[bminer]

Prevent stuff like <a href="javascript:blah">blah</a>

[joeytwiddle]

I love bookmarklets. Preventing this would make it impossible for someone to serve bookmarklets through a Blade template! (Witness my awesome bookmarklets and how badly they need a templating engine here. 😵)

That use-case is very small. But perhaps you could make it an option so that it can be disabled if needed.

(Also, some people like to write Javascript event handlers that way. We might agree that it is dirty and wrong, but occasionally it might be desirable, e.g. porting an old site over to Blade, doing the migration before fixing the handlers!)

[bminer]

I agree with you; this should be a configurable option in Blade (perhaps even off by default). I just opened the issue so that I wouldn't forget about it later.