url_decode(): return broken flag