In my wordpress site I have a hack that looks at the uri and does a redirect to a subdomain. The problem is wp_redirect calls wp_sanitize_redirect which will strip out @ signs, so when a user tries to load something like
The page that gets loaded should be
but instead it's
prefix.oursite.com?email=foobar.com (i.e. - no @ sign)
The problem is easy to work around - I just manually encode @ signs as %40 before calling wp_redirect.
Question: why does wp_sanitize_redirect strip out @ signs, exactly? Anybody could anyway try to load a url with an @ sign in it - is there some security issue I'm not thinking about?
EDIT: The function I'm talking about is wp_sanitize_redirect