hcuk94/phurl — pull request #4 by julfo (2012-09-27 18:36:47+00:00)
Title: XSS Vulnerability

When outputting the URL on the stats page, no escaping is used. This
presents a vulnerability for XSS (cross site scripting) attacks.
htmlspecialchars($url) will (hopefully) prevent any nefarious activity.
(see http://lop.li/lzKgP- for an example of this vulnerability in
practice)