fix RFI issue when attacker injects quoted url