Search code examples
phpinputsanitizationfilter-var

Is FILTER_SANITIZE_URL useless?

The documentation says:

Remove all characters except letters, digits and $-_.+!*'(),{}|\^~[]`<>#%";/?:@&=.

What's the point of using it if it allows quotes and stuff? I can just close the href attribute with " then put some JavaScript. Heck, I can put JavaScript even inside the URL.

Solution

  • It makes sure that the URL is valid. Protecting your presentation layer is up to you through use of well-known, battle-tested sanitization routines.