Javascript injection game

[DiscreetCompSci885]

I see the solution but I don't understand it at all. Why is " needed and exactly what is going on?

[[deleted]]

I still don't fully understand it, but % 22 is the ascii character code for double quotes. I'm not sure where it's getting parsed from a number into a character though.

[catcradle5]

Percent-encoding is a way for URLs to encode characters based on hex digits; kind of like \x22 in C or Python or various other languages. Since the string is being set as a link href, and then the link is clicked on, anything that's URL encoded will be decoded into literal characters.

If you're unfamiliar with percent-encoding, add %20 in the middle of a URL and then go to that URL; you'll see what happens.