I have created a patch for the gallery tag and have been given the following review. https://gerrit.wikimedia.org/r/4609 * JavaScript injection: you can inject javascript: URIs which execute code when clicked * plain links ("link=Firefox") are taken as relative URLs which will randomly work or not work depending on where they're viewed from * need parser test cases to demo it working So my questions are: What would be the recommended way of stripping away javascript from uris? Are there any shared functions which do exactly this? And how would i solve the plain links problem? do a regex check for an absolute uri? e.g http://example.org/foo/bar? And what is "parser test cases", phpunit tests? or some other form of testing? Thank you! Kim Eik.