> One more reason joining and splitting strings with security impact is a bad idea. Doing it in a standard/shared library is more secure than bespoke code on e

> One more reason joining and splitting strings with security impact is a bad idea. Doing it in a standard/shared library is more secure than bespoke code on each page, since at the very least as we witness here it can all be updated together as needed. You can add additional abstraction, but someone eventually has to do this work. Even web browsers themselves aren't immune from bugs in "joining and splitting strings with security impact" for URL comprehension. All you can really do is try not to re-write known secure code. Plus this buggy RegX was from the standard on URL parsing: https://tools.ietf.org/html/rfc3986#appendix-B https://tools.ietf.org/html/rfc3986#appendix-B