[ggggtez]

I don't think most browsers support redirect to javascript anymore. Maybe IE?

[dbielik]

Yes, they still do depending on how you redirect (i.e. unsanitized: location.href = url).

A nice benefit of using a framework like angular, Vue, react, etc, is that they prevent attacks like this unless you explicitly disable those features.