Fixed URL sanitization