# SEC-003: URL that runs code

**Error**: the page doesn't build until this is fixed.

`javascript:`, `vbscript:` and `data:text/html` URLs run code when they're opened, instead of opening a page.
They're a common way to slip scripts into a page, so Hypra doesn't write them.

## Fails

```hypra fails
page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  h1 "Shoes"
  a("javascript:openCart()") "Cart"
}
```

## Fixed

```hypra passes
page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  h1 "Shoes"
  a("/cart") "Cart"
  button(type: "button", "@click": "openCart()") "Quick view of the cart"
}
```