According to RFCs 3986 and 3987 (for IRIs), certain characters aren't permitted in the userinfo part (the optional username:password@ bit). Currently the URL validator doesn't check those characters, so invalid URLs such as http://example.com/">user@example.com are returned as valid.
According to RFCs 3986 and 3987 (for IRIs), certain characters aren't permitted in the userinfo part (the optional
username:password@bit). Currently the URL validator doesn't check those characters, so invalid URLs such ashttp://example.com/">user@example.comare returned as valid.