XSS - Which browsers automatically avoid URLs in the address bar?

Question

I did some xss / javascript-injection / penetration-testing on asp.net and noticed that modern web-browsers (i.e. the latest FF and Chrome) are escaping the URLs entered into the address bar.

So:

http://example.com/search/?q= "> <script> alert ('hi'); </script>

sent to my server as:

http://example.com/search/?q=%22%3e%3cscript%3ealert(%27hi%27)%3b%3c%2fscript%3e

Is there a list of all the (main) browsers that do this, and those that don't? Can mobile browsers do this?

Answer 1

I think all browsers avoid URLs except those that have errors and do not follow the RFC ( RFC3986 ).

Answer 2

If I'm not mistaken, you can use http://browsershots.org/ or something similar to check it out.

Test example: http://browsershots.org/requests/12461378