title: Is the use of window.location.href("javascript://code"); just as bad as eval?
body: <p>For instance:</p>
  
  <pre><code>    eval("alert('Hello there!');");
  
      // is just as bad as?
  
      window.location.href = "javascript:alert('Hello there!');void(0);";
  </code></pre>