5499:  sanitize $url variable