5637 anibal 1

things that come through the $_SERVER array and go into a URL should always go through Security::remove_XSS()