code: public void setHref (String href) 
      {
          if (_forceProtocol) {
              // This will correct URLs that don't have http:// as well
              // as provide protection against JS injection
              if ( ! href.matches("^\\s*\\w+://.*")) {
                  href = "http://" + href;
              }
          } else {
              // Always do some sort of JS protection
              if (href.trim().toLowerCase().startsWith("javascript:")) {
                  // He's been a naughty boy
                  href = "#";
              }
          }
  
          DOM.setElementProperty(getElement(), "href", href);
      }
docs: Set the href location.