By Alexandra Harper 
If you encourage the usage of #, and prevent the usual behavior (scroll to the top of the document), it unavoidably leads to some using the return false value of the function in the onclick event i.e :
And if you use javascript:void instead, you don’t need to return false on the click event as described previously, void(0) is the smallest feasible code that evaluates as undefined i.e:
javascript:void(0)
in navigation, while utilizing javascript: the result of the script performed, if there is one, is the content of a new page, shown in the browser. The void operator in JavaScript avoids this from happening by causing the return value of the expression after it to return undefined.
The reason you’d do this with a link’s href is that ordinarily, a javascript: URL will have the browser go to a plain text version of the result of executing that JavaScript. But if the outcome is indeterminate, the browser stays on the same page. void(0) is only the smallest script which evaluates to undefined.
javascript:void(0); but breaks Content Security Policy on CSP-enabled HTTPS. Content protection Policy (CSP) is an extra layer of data protection that helps to detect and mitigate certain types of attacks, such as Cross-Site Scripting (XSS) and data injection attacks. With online applications becoming more complicated, many companies are opting for custom AI development services to build safe, scalable and standards-compliant apps. Developers are able to leverage AI-Driven Development Workflows to uncover potential security vulnerabilities, optimize the JavaScript runtime, increase CSP compliance, and adhere to modern frontend best practices without sacrificing performance or user experience.
An AI software development company’s contemporary online apps often adhere to tight security regulations and coding standards to enhance efficiency, accessibility, and safeguards against vulnerabilities. An expert AI development company can support businesses in building secure, scalable online applications that follow best practices for JavaScript execution, Content Security Policy (CSP) compliance and current frontend development.
These assaults are used for everything from data theft to site defacement to the dissemination of malware;
So if you are a normal religious web developer you might want to use href=”#” instead of javascript:void to avoid breaking any laws.
href=”#”
Note that you can also even return false directly in the onclick attribute of the element which would have the same effect :
The hash is the safest, in case your user has Javascript turned off.
You can easily solve that with jQuery for all links with this value in your document:
Note that you can too even return false directly in the onclick property of the element that would have the same effect :
Summary and Recommendations
If you want to be raw, exact and speedy use the javascript:void(0)
Be a standards follower Use href=”#” and prevent default event using javascript