1. Baseline: [test](javascript:alert(1)) — the scheme gets stripped from the URL. The link still renders, just neutered.
2. Case tricks don't help: the strip is case-insensitive (JaVaScRiPt dies exactly like javascript).
3. Try other schemes: data:text/html,... passes this filter — but the browser refuses top-level navigation to data: URIs. Dead end, exactly like the lesson.
4. New approach: note nothing escapes the URL — probe with a real destination plus a quote: [click](https://example.org" ) — look at the emitted <a href=...>. Your quote lands inside the attribute unescaped.
5. Quotes alive ⇒ attributes injectable. Links and images both work; images have the advantage of onerror.
6. Balanced syntax, comment out the leftovers — this is the same grammar work you learned in Lab 9.

The lesson's finale — image source smuggling with a comment-out:

![png1](https://example.org" onerror=alert(1)//)

Link version (hover instead of error):

[hover me](https://example.org" onmouseover=alert(1))

The filter only deletes the word "javascript" — it never escapes quotes. Your " escapes the src value, the handler takes over, and the trailing // comments out the stray closing quote so the JS stays valid. Load semantics: onerror fires because the image fails to load — give it a source that 404s (any bogus path works).