ID: 51050
Updated by: jani@php.net
Reported By: pecoes at gmail dot com
-Status: Open
+Status: Bogus
Bug Type: Filter related
Operating System: WinXP
PHP Version: 5.3.1
New Comment:
validate != filter. There's nothing wrong in the url syntax so it's
passed on. More in the manual: http://php.net/filter
Previous Comments:
------------------------------------------------------------------------
[2010-02-15 05:21:37] pecoes at gmail dot com
Description:
------------
Look at the code and its result. How is that validation?
Reproduce code:
---------------
$url = 'http://example.org/"><script>alert(\'oops\');</script';
echo '<a href="', filter_var($url, FILTER_VALIDATE_URL),
'">test</a>';
Expected result:
----------------
<a href="">test</a>
Actual result:
--------------
<a href="http://example.org/"><script>alert('oops');</script">test</a>
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=51050&edit=1