1These links should be unsafe and not allowed in safe_mode
2
3[link](javascript:alert%28'Hello%20world!'%29)
4[link](vbscript:msgbox%28%22Hello%20world!%22%29)
5[link](livescript:alert%28'Hello%20world!'%29)
6[link](mocha:[code])
7[link](jAvAsCrIpT:alert%28'Hello%20world!'%29)
8[link](ja vas cr ipt:alert%28'Hello%20world!'%29)
9[link](ja vas cr ipt:alert%28'Hello%20world!'%29)
10[link](ja vas cr ipt:alert%28'Hello%20world!'%29)
11[link](ja%09 %0Avas cr
ipt:alert%28'Hello%20world!'%29)
12[link](ja%20vas%20cr%20ipt:alert%28'Hello%20world!'%29)
13[link](live%20script:alert%28'Hello%20world!'%29)
14
15![img](javascript:alert%29'XSS'%29)
16[ref][]
17![imgref][]
18
19[ref]: javascript:alert%29'XSS'%29
20[imgref]: javascript:alert%29'XSS'%29
21
22These should work regardless:
23
24[relative](relative/url.html)
25[email](mailto:foo@bar.com)
26[news scheme](news:some.news.group.com)
27[http link](http://example.com)
28