url sanitization works on local