Fixed URL filtering (was only validating, not sanitizing)