The parse_url vulnerability is probably a good example of why you don't want to use blacklists for filtering out malicious input; you want to use whitelists, and then you want to reconstitute the thing you parsed into a form that can be parsed unambiguously.<p>parse_url(" javascript:alert('hello')") yields<p><pre><code> Array
(
[path] => javascript:alert('hello')
)
</code></pre>
which clearly does not have an URL scheme on any whitelist you might apply. Even if it had incorrectly claimed the scheme was "http", the reconstitution step would give you an URL like "<a href="http://localhost/%20javascript:alert(hello)" rel="nofollow">http://localhost/%20javascript:alert(hello)</a>, which would avoid the problem.