note 118257 added to function.filter-var

FILTER_VALIDATE_URL allows: filter_var('javascript://comment%0Aalert(1)', FILTER_VALIDATE_URL); Where the %0A (URL encoded newline), in certain contexts, will split the comment from the JS code. This can result in an XSS vulnerability. ---- Server IP: 72.52.91.14 Probable Submitter: 82.44.123.130 ---- Manual Page -- http://php.net/manual/en/function.filter-var.php Edit -- https://master.php.net/note/edit/118257 Del: integrated -- https://master.php.net/note/delete/118257/integrated Del: useless -- https://master.php.net/note/delete/118257/useless Del: bad code -- https://master.php.net/note/delete/118257/bad+code Del: spam -- https://master.php.net/note/delete/118257/spam Del: non-english -- https://master.php.net/note/delete/118257/non-english Del: in docs -- https://master.php.net/note/delete/118257/in+docs Del: other reasons-- https://master.php.net/note/delete/118257 Reject -- https://master.php.net/note/reject/118257 Search -- https://master.php.net/manage/user-notes.php