Bug #74599 [Nab]: parse_url allows bad characters in the common name

Edit report at https://bugs.php.net/bug.php?id=74599&edit=1 ID: 74599 User updated by: bj dot cardon at gmail dot com Reported by: bj dot cardon at gmail dot com Summary: parse_url allows bad characters in the common name Status: Not a bug Type: Bug Package: URL related Operating System: Linux PHP Version: 7.0.19 Block user comment: N Private report: N New Comment: I don't need "validation". I need a function that claims to parse a URL to not parse the URL in a nonsensical way. The documentation also says: > Invalid characters are replaced by _ Which is not happening with the invalid character of '\'. Previous Comments: ------------------------------------------------------------------------ [2017-05-15 23:56:20] requinix@php.net Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php > This function is not meant to validate the given URL, it only breaks it up into > the above listed parts. ------------------------------------------------------------------------ [2017-05-15 18:51:56] bj dot cardon at gmail dot com Description: ------------ As the title says, the parse_url function allows backslashes to be in the hostname part of a URL and considers it valid. You can see the test script below showing this behavior. Test script: --------------- bcardon@bcardon-base:~$ php -a Interactive mode enabled php > $u = parse_url("https://www.example.com\\.google.com"); php > print_r($u); Array ( [scheme] => https [host] => www.example.com\.google.com ) Expected result: ---------------- The expected behavior is that invalid characters (including backslashes) will cause parse_url to return FALSE as with any invalid URL. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=74599&edit=1