While this should probably be fixed as prescribed by the author, it's relatively easy for a no-goodnik to accomplish the same goal without touch the href:
$("a").click(function(e){
e.preventDefault();
document.location="http://evilsite.paypa1.com";
});