ID: 51050 Updated by: [email protected] Reported By: pecoes at gmail dot com -Status: Open +Status: Bogus Bug Type: Filter related Operating System: WinXP PHP Version: 5.3.1 New Comment:
validate != filter. There's nothing wrong in the url syntax so it's passed on. More in the manual: http://php.net/filter Previous Comments: ------------------------------------------------------------------------ [2010-02-15 05:21:37] pecoes at gmail dot com Description: ------------ Look at the code and its result. How is that validation? Reproduce code: --------------- $url = 'http://example.org/";><script>alert(\'oops\');</script'; echo '<a href="', filter_var($url, FILTER_VALIDATE_URL), '">test</a>'; Expected result: ---------------- <a href="">test</a> Actual result: -------------- <a href="http://example.org/";><script>alert('oops');</script">test</a> ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=51050&edit=1
