[doc-en] master: `FILTER_VALIDATE_URL`: document limited host validation

Author: Daniel Scherzer (DanielEScherzer) Date: 2026-09-20T14:44:34-07:00 Commit: https://github.com/php/doc-en/commit/09d46e4a79e10ad516b84fd47d4ac04aa7126b73 Raw diff: https://github.com/php/doc-en/commit/09d46e4a79e10ad516b84fd47d4ac04aa7126b73.diff FILTER_VALIDATE_URL: document limited host validation Changed paths: M reference/filter/constants.xml Diff: diff --git a/reference/filter/constants.xml b/reference/filter/constants.xml index 2c1555fc4d7c..7706f3cb13f8 100644 --- a/reference/filter/constants.xml +++ b/reference/filter/constants.xml @@ -614,6 +614,29 @@ This means that Internationalized Domain Names (IDN) will always be rejected. </simpara> </warning> + <warning> + <simpara> + This filter is very permissive. For any scheme other than + <literal>http://</literal> or <literal>https://</literal>, host content + will be accepted without any validation. + </simpara> + <informalexample> + <programlisting role="php"> +<![CDATA[ +<?php + +var_dump(filter_var('javascript://x%0aalert(1)', FILTER_VALIDATE_URL)); +?> +]]> + </programlisting> + &example.outputs; + <screen> +<![CDATA[ +string(25) "javascript://x%0aalert(1)" +]]> + </screen> + </informalexample> + </warning> </listitem> </varlistentry> <varlistentry xml:id="constant.filter-validate-domain">