Yes, they still do depending on how you redirect (i.e. unsanitized: location.href = url). A nice benefit of using a framework like angular, Vue, react, etc, is

Yes, they still do depending on how you redirect (i.e. unsanitized: location.href = url). A nice benefit of using a framework like angular, Vue, react, etc, is that they prevent attacks like this unless you explicitly disable those features.