Description:
------------
The function parse_url wrongly handle backslash "\" in URL username.

If you try to call parse_url on URL with a value like: 
"//example.com\@google.com"

"host" value will be "google.com" and username "example.com\" 
Whereas browser (Chrome/Firefox at least) will consider "example.com" as the domain and "@google.com as the path

Tested as a HTML link href and has a HTTP "Header location", on both case, the browser considere the domain as "example.com"

This works with all scheme http,https and //

The RFC 3986 do not deals how to exactly handle backslash value.
But we can assume that handling URL like major browser should be the way to do.
They seems to replace backslash by slash.

This is a security concern because parse_url is used to validate URL and a value injection could lead in wrong host detection.

This vulnerability is already actively used - I found some attempts into my server logs.

Can reproduce the issue on 7.4.3 (Unix) / 8.1.2 (Windows) / 8.2.1 (MacOS) 


Test script:
---------------
<?php

$url = '//example.com\@google.com';

var_dump($url);

// Here the domain displayed is "google.com"
var_dump(parse_url($url));

// Click and you will be redirected to "example.com"
?><a href="<?= $url; ?>" target="_blank">Test URL in a browser</a>

Expected result:
----------------
Parsing should return false or example.com in the domain and "@google.com" as a path