# Prevent users from injecting hyperlinks in Form Fields

**URL:** <https://community.hubspot.com/t/prevent-users-from-injecting-hyperlinks-in-form-fields/130484>\
**Category:** APIs & Integrations\
**Tags:** forms\
**Created:** [April 24, 2025, 1:36pm UTC](https://community.hubspot.com/t/prevent-users-from-injecting-hyperlinks-in-form-fields/130484 "2025-04-24T13:36:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![KMaslarski](https://avatars.discourse-cdn.com/v4/letter/k/958977/32.png) [@KMaslarski](https://community.hubspot.com/u/KMaslarski)\
**Post date:** [April 24, 2025, 1:36pm UTC](https://community.hubspot.com/t/prevent-users-from-injecting-hyperlinks-in-form-fields/130484/1 "2025-04-24T13:36:24Z")

</div>

We are currently facing an issue with users trying to inject hyperlinks in form fields like first and last name, and currently, there is no solution from Hubspot.

The AI support Chatbot asked me to use the following code to prevent this from happening:

\<script\>document.addEventListener(“DOMContentLoaded”, function () { const form = document.querySelector(‘#formid’); if (!form) { console.log(“Form not found.”); return; } form.addEventListener(‘submit’, function (e) { const inputs = form.querySelectorAll(‘input, textarea’); let valid = true; inputs.forEach(input =\> { console.log(`Checking input: ${input.value}`); const pattern = /https?:\/\/[^\s]+/; if (pattern.test(input.value)) { valid = false; alert(‘No hyperlinks allowed!’); console.log(‘Hyperlink detected:’, input.value); } }); if (!valid) { console.log(‘Form submission blocked due to hyperlink.’); e.preventDefault(); } });});\</script\>

But sadly, it didn’t work. Looking for any help to solve this issue.

Thank you!

---

<div class="post-metadata">

**Author:** ![MichaelMa](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@MichaelMa](https://community.hubspot.com/u/MichaelMa)\
**Post date:** [April 24, 2025, 4:51pm UTC](https://community.hubspot.com/t/prevent-users-from-injecting-hyperlinks-in-form-fields/130484/2 "2025-04-24T16:51:49Z")

</div>

Do you have access to edit the property fields? You can put a rule on the property to disallow certain characters which would also be applied to forms, I believe.

Eg,

Property Rule:

 ![MichaelMa_0-1745513434863.png](https://d2qpr2jzcazej7.cloudfront.net/original/3X/b/a/ba8ab91c23e392bb5d6703c70448e97afbb28c16.png)

Form:

 ![MichaelMa_1-1745513484207.png](https://d2qpr2jzcazej7.cloudfront.net/original/3X/3/9/391828c9ee297e89b7f69f4426d6609a712688cf.png)