Description:
------------
The parse_url function turns the tab character into an underscore.  This turns an invalid URL into a valid one.  If you are attempting to validate user input with parse_url then it will pass validation even though tab is an invalid character in a host name or FQDN.  It may be difficult to see in the example below but there is a tab.

Test script:
---------------
<?php
$host = "http://test	url";
var_dump(parse_url($host));
?>

Expected result:
----------------
array(2) { ["scheme"]=> string(4) "http" ["host"]=> string(8) "test	url" } 
or 
array(2) { ["scheme"]=> string(4) "http" ["host"]=> string(8) "test\turl" } 

Actual result:
--------------
array(2) { ["scheme"]=> string(4) "http" ["host"]=> string(8) "test_url" }