The original title is 12 words: "PHP 8.5's New URI Extension: Parsing URLs Without the parse_url() Footguns"

Short summary

PHP 8.5 adds Uri\Rfc3986\Uri and Uri\WhatWg\Url classes to replace parse_url(), which has enabled SSRF vulnerabilities by disagreeing with HTTP clients on URL parsing. The new API provides typed getters, normalization, and proper error handling. Developers should match their validator's parser to their client's parser to close the security gap.

• •PHP 8.5 adds two standards-compliant URI parsers to replace the 20-year-old parse_url()
• •parse_url()'s disagreement with HTTP clients/browsers enables SSRF vulnerabilities
• •New Uri classes provide typed getters, normalization, and structured error handling

Generated with AI, which can make mistakes.