Prevent XSS by stripping tags from $_SERVER['REQUEST_URI'].

[jhowardjr]

When $og->url() is called, without a parameter, tags can be injected into the page where the og tags are rendered. Here's an example of how it can be done:
http://example.com/?"><script>alert(1234)</script>

[chriskonnertz]

Hello,

thank you for reporting this security issue.

What is the intention of the second line?

$safeRequestURI = preg_replace('/alert|log/is','',$safeRequestURI);

For example, this is a valid URL:

http://localhost/opengraph/test.php?alert=test

Your code transforms this URL to:

http://localhost/opengraph/test.php?=test

This seems unnecessary to me?

[jhowardjr]

I was testing something else it is unnecessary.

[chriskonnertz]

Thanks!