Fix URL rewriter issues

1 files changed, 699 insertions, 332 deletions

diff --git a/ext/standard/url_scanner_ex.c b/ext/standard/url_scanner_ex.c
index 07ebbe09a2..04a55e22cd 100644
--- a/ext/standard/url_scanner_ex.c
+++ b/ext/standard/url_scanner_ex.c
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 */
+/* Generated by re2c 0.14.3 */
 #line 1 "ext/standard/url_scanner_ex.re"
 /*
   +----------------------------------------------------------------------+
@@ -15,6 +15,7 @@
   | license@php.net so we can mail you a copy immediately.               |
   +----------------------------------------------------------------------+
   | Author: Sascha Schumann <sascha@schumann.cx>                         |
+  |         Yasuo Ohgaki <yohgaki@ohgaki.net>                            |
   +----------------------------------------------------------------------+
 */
 
@@ -33,11 +34,14 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include "SAPI.h"
 #include "php_ini.h"
 #include "php_globals.h"
+#include "php_string.h"
 #define STATE_TAG SOME_OTHER_STATE_TAG
 #include "basic_functions.h"
 #include "url.h"
+#include "html.h"
 #undef STATE_TAG
 
 #define url_scanner url_scanner_ex
@@ -49,14 +53,18 @@ static void tag_dtor(zval *zv)
 	free(Z_PTR_P(zv));
 }
 
-static PHP_INI_MH(OnUpdateTags)
+static int php_ini_on_update_tags(zend_ini_entry *entry, zend_string *new_value, void *mh_arg1, void *mh_arg2, void *mh_arg3, int stage, int type)
 {
 	url_adapt_state_ex_t *ctx;
 	char *key;
 	char *tmp;
 	char *lasts = NULL;
 
-	ctx = &BG(url_adapt_state_ex);
+	if (type) {
+		ctx = &BG(url_adapt_session_ex);
+	} else {
+		ctx = &BG(url_adapt_output_ex);
+	}
 
 	tmp = estrndup(ZSTR_VAL(new_value), ZSTR_LEN(new_value));
 
@@ -72,8 +80,8 @@ static PHP_INI_MH(OnUpdateTags)
 	zend_hash_init(ctx->tags, 0, NULL, tag_dtor, 1);
 
 	for (key = php_strtok_r(tmp, ",", &lasts);
-			key;
-			key = php_strtok_r(NULL, ",", &lasts)) {
+		 key;
+		 key = php_strtok_r(NULL, ",", &lasts)) {
 		char *val;
 
 		val = strchr(key, '=');
@@ -82,11 +90,10 @@ static PHP_INI_MH(OnUpdateTags)
 			size_t keylen;
 
 			*val++ = '\0';
-			for (q = key; *q; q++)
+			for (q = key; *q; q++) {
 				*q = tolower(*q);
+			}
 			keylen = q - key;
-			/* key is stored withOUT NUL
-			   val is stored WITH    NUL */
 			zend_hash_str_add_mem(ctx->tags, key, keylen, val, strlen(val)+1);
 		}
 	}
@@ -96,11 +103,73 @@ static PHP_INI_MH(OnUpdateTags)
 	return SUCCESS;
 }
 
+static PHP_INI_MH(OnUpdateSessionTags)
+{
+	return php_ini_on_update_tags(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage, 1);
+}
+
+static PHP_INI_MH(OnUpdateOutputTags)
+{
+	return php_ini_on_update_tags(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage, 0);
+}
+
+static int php_ini_on_update_hosts(zend_ini_entry *entry, zend_string *new_value, void *mh_arg1, void *mh_arg2, void *mh_arg3, int stage, int type)
+{
+	HashTable *hosts;
+	char *key;
+	char *tmp;
+	char *lasts = NULL;
+
+	if (type) {
+		hosts = &BG(url_adapt_session_hosts_ht);
+	} else {
+		hosts = &BG(url_adapt_output_hosts_ht);
+	}
+	zend_hash_clean(hosts);
+
+	/* Use user supplied host whitelist */
+	tmp = estrndup(ZSTR_VAL(new_value), ZSTR_LEN(new_value));
+	for (key = php_strtok_r(tmp, ",", &lasts);
+		 key;
+		 key = php_strtok_r(NULL, ",", &lasts)) {
+		size_t keylen;
+		zend_string *tmp_key;
+		char *q;
+
+		for (q = key; *q; q++) {
+			*q = tolower(*q);
+		}
+		keylen = q - key;
+		if (keylen > 0) {
+			tmp_key = zend_string_init(key, keylen, 0);
+			zend_hash_add_empty_element(hosts, tmp_key);
+			zend_string_release(tmp_key);
+		}
+	}
+	efree(tmp);
+
+	return SUCCESS;
+}
+
+static PHP_INI_MH(OnUpdateSessionHosts)
+{
+	return php_ini_on_update_hosts(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage, 1);
+}
+
+static PHP_INI_MH(OnUpdateOutputHosts)
+{
+	return php_ini_on_update_hosts(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage, 0);
+}
+
+/* FIXME: OnUpdate*Hosts cannot set default to $_SERVER['HTTP_HOST'] at startup */
 PHP_INI_BEGIN()
-	STD_PHP_INI_ENTRY("url_rewriter.tags", "a=href,area=href,frame=src,form=,fieldset=", PHP_INI_ALL, OnUpdateTags, url_adapt_state_ex, php_basic_globals, basic_globals)
+	STD_PHP_INI_ENTRY("session.trans_sid_tags", "a=href,area=href,frame=src,form=", PHP_INI_ALL, OnUpdateSessionTags, url_adapt_session_ex, php_basic_globals, basic_globals)
+	STD_PHP_INI_ENTRY("session.trans_sid_hosts", "", PHP_INI_ALL, OnUpdateSessionHosts, url_adapt_session_hosts_ht, php_basic_globals, basic_globals)
+	STD_PHP_INI_ENTRY("url_rewriter.tags", "form=", PHP_INI_ALL, OnUpdateOutputTags, url_adapt_session_ex, php_basic_globals, basic_globals)
+	STD_PHP_INI_ENTRY("url_rewriter.hosts", "", PHP_INI_ALL, OnUpdateOutputHosts, url_adapt_session_hosts_ht, php_basic_globals, basic_globals)
 PHP_INI_END()
 
-#line 107 "ext/standard/url_scanner_ex.re"
+#line 176 "ext/standard/url_scanner_ex.re"
 
 
 #define YYFILL(n) goto done
@@ -111,106 +180,101 @@ PHP_INI_END()
 
 static inline void append_modified_url(smart_str *url, smart_str *dest, smart_str *url_app, const char *separator)
 {
-	register const char *p, *q;
-	const char *bash = NULL;
-	const char *sep = "?";
-
-	q = (p = ZSTR_VAL(url->s)) + ZSTR_LEN(url->s);
-
-scan:
+	php_url *url_parts;
+	char *tmp;
+	size_t tmp_len;
 
-#line 123 "ext/standard/url_scanner_ex.c"
-{
-	YYCTYPE yych;
-	static const unsigned char yybm[] = {
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128,   0, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128,   0, 128, 128, 128, 128,   0, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-		128, 128, 128, 128, 128, 128, 128, 128, 
-	};
+	smart_str_0(url); /* FIXME: Bug #70480 php_url_parse_ex() crashes by processing chars exceed len */
+	url_parts = php_url_parse_ex(ZSTR_VAL(url->s), ZSTR_LEN(url->s));
 
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yybm[0+yych] & 128) {
-		goto yy8;
-	}
-	if (yych <= '9') goto yy6;
-	if (yych >= ';') goto yy4;
-	++YYCURSOR;
-#line 125 "ext/standard/url_scanner_ex.re"
-	{ smart_str_append_smart_str(dest, url); return; }
-#line 171 "ext/standard/url_scanner_ex.c"
-yy4:
-	++YYCURSOR;
-#line 126 "ext/standard/url_scanner_ex.re"
-	{ sep = separator; goto scan; }
-#line 176 "ext/standard/url_scanner_ex.c"
-yy6:
-	++YYCURSOR;
-#line 127 "ext/standard/url_scanner_ex.re"
-	{ bash = p - 1; goto done; }
-#line 181 "ext/standard/url_scanner_ex.c"
-yy8:
-	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yybm[0+yych] & 128) {
-		goto yy8;
+	/* Ignore malformed URLs */
+	if (!url_parts) {
+		smart_str_append_smart_str(dest, url);
+		return;
 	}
-#line 128 "ext/standard/url_scanner_ex.re"
-	{ goto scan; }
-#line 191 "ext/standard/url_scanner_ex.c"
-}
-#line 129 "ext/standard/url_scanner_ex.re"
 
-done:
-
-	/* Don't modify URLs of the format "#mark" */
-	if (bash && bash - ZSTR_VAL(url->s) == 0) {
+	/* Check protocol. Only http/https is allowed. */
+	if (url_parts->scheme
+		&& strcasecmp("http", url_parts->scheme)
+		&& strcasecmp("https", url_parts->scheme)) {
 		smart_str_append_smart_str(dest, url);
+		php_url_free(url_parts);
 		return;
 	}
 
-	if (bash)
-		smart_str_appendl(dest, ZSTR_VAL(url->s), bash - ZSTR_VAL(url->s));
-	else
+	/* Check host whitelist. If it's not listed, do nothing. */
+	if (url_parts->host
+		&& (tmp_len = strlen(url_parts->host))
+		&& (tmp = php_strtolower(url_parts->host, tmp_len))
+		&& !zend_hash_str_find(&BG(url_adapt_session_hosts_ht), tmp, tmp_len)) {
 		smart_str_append_smart_str(dest, url);
+		php_url_free(url_parts);
+		return;
+	}
 
-	smart_str_appends(dest, sep);
-	smart_str_append_smart_str(dest, url_app);
+	/*
+	 * When URL does not have path and query string add "/?".
+	 * i.e. If URL is only "?foo=bar", should not add "/?".
+	 */
+	if (!url_parts->path && !url_parts->query) {
+		/* URL is http://php.net or like */
+		smart_str_append_smart_str(dest, url);
+		smart_str_appendc(dest, '/');
+		smart_str_appendc(dest, '?');
+		smart_str_append_smart_str(dest, url_app);
+		/* There should not be fragment. Just return */
+		php_url_free(url_parts);
+		return;
+	}
 
-	if (bash)
-		smart_str_appendl(dest, bash, q - bash);
+	if (url_parts->scheme) {
+		smart_str_appends(dest, url_parts->scheme);
+		smart_str_appends(dest, "://");
+	} else if (*(ZSTR_VAL(url->s)) == '/' && *(ZSTR_VAL(url->s)+1) == '/') {
+		smart_str_appends(dest, "//");
+	}
+	if (url_parts->user) {
+		smart_str_appends(dest, url_parts->user);
+		if (url_parts->pass) {
+			smart_str_appends(dest, url_parts->pass);
+			smart_str_appendc(dest, ':');
+		}
+		smart_str_appendc(dest, '@');
+	}
+	if (url_parts->host) {
+				smart_str_appends(dest, url_parts->host);
+	}
+	if (url_parts->port) {
+		smart_str_appendc(dest, ':');
+		smart_str_append_unsigned(dest, (long)url_parts->port);
+	}
+	if (url_parts->path) {
+		smart_str_appends(dest, url_parts->path);
+	}
+	smart_str_appendc(dest, '?');
+	if (url_parts->query) {
+		smart_str_appends(dest, url_parts->query);
+		smart_str_appends(dest, separator);
+		smart_str_append_smart_str(dest, url_app);
+	} else {
+		smart_str_append_smart_str(dest, url_app);
+	}
+	if (url_parts->fragment) {
+		smart_str_appendc(dest, '#');
+		smart_str_appends(dest, url_parts->fragment);
+	}
+	php_url_free(url_parts);
 }
 
+enum {
+	TAG_NORMAL = 0,
+	TAG_FORM
+};
+
+enum {
+	ATTR_NORMAL = 0,
+	ATTR_ACTION
+};
 
 #undef YYFILL
 #undef YYCTYPE
@@ -222,18 +286,24 @@ static inline void tag_arg(url_adapt_state_ex_t *ctx, char quotes, char type)
 {
 	char f = 0;
 
-	if (strncasecmp(ZSTR_VAL(ctx->arg.s), ctx->lookup_data, ZSTR_LEN(ctx->arg.s)) == 0)
+	/* arg.s is string WITHOUT NUL.
+	   To avoid partial match, NUL is added here */
+	ZSTR_VAL(ctx->arg.s)[ZSTR_LEN(ctx->arg.s)] = '\0';
+	if (!strcasecmp(ZSTR_VAL(ctx->arg.s), ctx->lookup_data)) {
 		f = 1;
+	}
 
-	if (quotes)
+	if (quotes) {
 		smart_str_appendc(&ctx->result, type);
+	}
 	if (f) {
 		append_modified_url(&ctx->val, &ctx->result, &ctx->url_app, PG(arg_separator).output);
 	} else {
 		smart_str_append_smart_str(&ctx->result, &ctx->val);
 	}
-	if (quotes)
+	if (quotes) {
 		smart_str_appendc(&ctx->result, type);
+	}
 }
 
 enum {
@@ -267,11 +337,79 @@ static inline void passthru(STD_PARA)
 	smart_str_appendl(&ctx->result, start, YYCURSOR - start);
 }
 
+
+static int check_http_host(char *target)
+{
+	zval *host, *tmp;
+	zend_string *host_tmp;
+	char *colon;
+
+	if ((tmp  = zend_hash_str_find(&EG(symbol_table), ZEND_STRL("_SERVER"))) &&
+		(host = zend_hash_str_find(Z_ARRVAL_P(tmp), ZEND_STRL("HTTP_HOST"))) &&
+		Z_TYPE_P(host) == IS_STRING) {
+		host_tmp = zend_string_init(Z_STRVAL_P(host), Z_STRLEN_P(host), 0);
+		/* HTTP_HOST could be 'localhost:8888' etc. */
+		colon = strchr(ZSTR_VAL(host_tmp), ':');
+		if (colon) {
+			ZSTR_LEN(host_tmp) = colon - ZSTR_VAL(host_tmp);
+			ZSTR_VAL(host_tmp)[ZSTR_LEN(host_tmp)] = '\0';
+		}
+		if (!strcasecmp(ZSTR_VAL(host_tmp), target)) {
+			zend_string_release(host_tmp);
+			return SUCCESS;
+		}
+		zend_string_release(host_tmp);
+	}
+	return FAILURE;
+}
+
+static int check_host_whitelist(url_adapt_state_ex_t *ctx)
+{
+	php_url *url_parts = NULL;
+	HashTable *allowed_hosts = ctx->type ? &BG(url_adapt_session_hosts_ht) : &BG(url_adapt_output_hosts_ht);
+
+	ZEND_ASSERT(ctx->tag_type == TAG_FORM);
+
+	if (ctx->attr_val.s && ZSTR_LEN(ctx->attr_val.s)) {
+		url_parts = php_url_parse_ex(ZSTR_VAL(ctx->attr_val.s), ZSTR_LEN(ctx->attr_val.s));
+	} else {
+		return SUCCESS; /* empty URL is valid */
+	}
+
+	if (!url_parts) {
+		return FAILURE;
+	}
+	if (url_parts->scheme) {
+		/* Only http/https should be handled.
+		   A bit hacky check this here, but saves a URL parse. */
+		if (strcasecmp(url_parts->scheme, "http") &&
+			strcasecmp(url_parts->scheme, "https")) {
+		php_url_free(url_parts);
+		return FAILURE;
+		}
+	}
+	if (!url_parts->host) {
+		php_url_free(url_parts);
+		return SUCCESS;
+	}
+	if (!zend_hash_num_elements(allowed_hosts) &&
+		check_http_host(url_parts->host) == SUCCESS) {
+		php_url_free(url_parts);
+		return SUCCESS;
+	}
+	if (!zend_hash_str_find(allowed_hosts,
+							url_parts->host,
+							strlen(url_parts->host))) {
+		php_url_free(url_parts);
+		return FAILURE;
+	}
+	php_url_free(url_parts);
+	return SUCCESS;
+}
+
 /*
- * This function appends a hidden input field after a <form> or
- * <fieldset>.  The latter is important for XHTML.
+ * This function appends a hidden input field after a <form>.
  */
-
 static void handle_form(STD_PARA)
 {
 	int doit = 0;
@@ -279,32 +417,16 @@ static void handle_form(STD_PARA)
 	if (ZSTR_LEN(ctx->form_app.s) > 0) {
 		switch (ZSTR_LEN(ctx->tag.s)) {
 			case sizeof("form") - 1:
-				if (!strncasecmp(ZSTR_VAL(ctx->tag.s), "form", sizeof("form") - 1)) {
-					doit = 1;
-				}
-				if (doit && ctx->val.s && ctx->lookup_data && *ctx->lookup_data) {
-					char *e, *p = (char *)zend_memnstr(ZSTR_VAL(ctx->val.s), "://", sizeof("://") - 1, ZSTR_VAL(ctx->val.s) + ZSTR_LEN(ctx->val.s));
-					if (p) {
-						e = memchr(p, '/', (ZSTR_VAL(ctx->val.s) + ZSTR_LEN(ctx->val.s)) - p);
-						if (!e) {
-							e = ZSTR_VAL(ctx->val.s) + ZSTR_LEN(ctx->val.s);
-						}
-						if ((e - p) && strncasecmp(p, ctx->lookup_data, (e - p))) {
-							doit = 0;
-						}
-					}
-				}
-				break;
-
-			case sizeof("fieldset") - 1:
-				if (!strncasecmp(ZSTR_VAL(ctx->tag.s), "fieldset", sizeof("fieldset") - 1)) {
+				if (!strncasecmp(ZSTR_VAL(ctx->tag.s), "form", ZSTR_LEN(ctx->tag.s))
+					&& check_host_whitelist(ctx) == SUCCESS) {
 					doit = 1;
 				}
 				break;
 		}
+	}
 
-		if (doit)
-			smart_str_append_smart_str(&ctx->result, &ctx->form_app);
+	if (doit) {
+		smart_str_append_smart_str(&ctx->result, &ctx->form_app);
 	}
 }
 
@@ -327,8 +449,15 @@ static inline void handle_tag(STD_PARA)
 	for (i = 0; i < ZSTR_LEN(ctx->tag.s); i++)
 		ZSTR_VAL(ctx->tag.s)[i] = tolower((int)(unsigned char)ZSTR_VAL(ctx->tag.s)[i]);
     /* intentionally using str_find here, in case the hash value is set, but the string val is changed later */
-	if ((ctx->lookup_data = zend_hash_str_find_ptr(ctx->tags, ZSTR_VAL(ctx->tag.s), ZSTR_LEN(ctx->tag.s))) != NULL)
+	if ((ctx->lookup_data = zend_hash_str_find_ptr(ctx->tags, ZSTR_VAL(ctx->tag.s), ZSTR_LEN(ctx->tag.s))) != NULL) {
 		ok = 1;
+		if (ZSTR_LEN(ctx->tag.s) == sizeof("form")-1
+			&& !strncasecmp(ZSTR_VAL(ctx->tag.s), "form", ZSTR_LEN(ctx->tag.s))) {
+			ctx->tag_type = TAG_FORM;
+		} else {
+			ctx->tag_type = TAG_NORMAL;
+		}
+	}
 	STATE = ok ? STATE_NEXT_ARG : STATE_PLAIN;
 }
 
@@ -338,11 +467,20 @@ static inline void handle_arg(STD_PARA)
 		ZSTR_LEN(ctx->arg.s) = 0;
 	}
 	smart_str_appendl(&ctx->arg, start, YYCURSOR - start);
+	if (ctx->tag_type == TAG_FORM &&
+		strncasecmp(ZSTR_VAL(ctx->arg.s), "action", ZSTR_LEN(ctx->arg.s)) == 0) {
+		ctx->attr_type = ATTR_ACTION;
+	} else {
+		ctx->attr_type = ATTR_NORMAL;
+	}
 }
 
 static inline void handle_val(STD_PARA, char quotes, char type)
 {
 	smart_str_setl(&ctx->val, start + quotes, YYCURSOR - start - quotes * 2);
+	if (ctx->tag_type == TAG_FORM && ctx->attr_type == ATTR_ACTION) {
+		smart_str_setl(&ctx->attr_val, start + quotes, YYCURSOR - start - quotes * 2);
+	}
 	tag_arg(ctx, quotes, type);
 }
 
@@ -374,7 +512,7 @@ state_plain_begin:
 state_plain:
 	start = YYCURSOR;
 
-#line 378 "ext/standard/url_scanner_ex.c"
+#line 516 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -411,33 +549,34 @@ state_plain:
 		128, 128, 128, 128, 128, 128, 128, 128, 
 		128, 128, 128, 128, 128, 128, 128, 128, 
 	};
+
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
 	if (yybm[0+yych] & 128) {
-		goto yy15;
+		goto yy4;
 	}
 	++YYCURSOR;
-#line 313 "ext/standard/url_scanner_ex.re"
+#line 518 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); STATE = STATE_TAG; goto state_tag; }
-#line 423 "ext/standard/url_scanner_ex.c"
-yy15:
+#line 562 "ext/standard/url_scanner_ex.c"
+yy4:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
 	if (yybm[0+yych] & 128) {
-		goto yy15;
+		goto yy4;
 	}
-#line 314 "ext/standard/url_scanner_ex.re"
+#line 519 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); goto state_plain; }
-#line 433 "ext/standard/url_scanner_ex.c"
+#line 572 "ext/standard/url_scanner_ex.c"
 }
-#line 315 "ext/standard/url_scanner_ex.re"
+#line 520 "ext/standard/url_scanner_ex.re"
 
 
 state_tag:
 	start = YYCURSOR;
 
-#line 441 "ext/standard/url_scanner_ex.c"
+#line 580 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -477,36 +616,36 @@ state_tag:
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
 	if (yych <= '@') {
-		if (yych != ':') goto yy22;
+		if (yych != ':') goto yy11;
 	} else {
-		if (yych <= 'Z') goto yy20;
-		if (yych <= '`') goto yy22;
-		if (yych >= '{') goto yy22;
+		if (yych <= 'Z') goto yy9;
+		if (yych <= '`') goto yy11;
+		if (yych >= '{') goto yy11;
 	}
-yy20:
+yy9:
 	++YYCURSOR;
 	yych = *YYCURSOR;
-	goto yy25;
-yy21:
-#line 320 "ext/standard/url_scanner_ex.re"
+	goto yy14;
+yy10:
+#line 525 "ext/standard/url_scanner_ex.re"
 	{ handle_tag(STD_ARGS); /* Sets STATE */; passthru(STD_ARGS); if (STATE == STATE_PLAIN) goto state_plain; else goto state_next_arg; }
-#line 494 "ext/standard/url_scanner_ex.c"
-yy22:
+#line 633 "ext/standard/url_scanner_ex.c"
+yy11:
 	++YYCURSOR;
-#line 321 "ext/standard/url_scanner_ex.re"
+#line 526 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); goto state_plain_begin; }
-#line 499 "ext/standard/url_scanner_ex.c"
-yy24:
+#line 638 "ext/standard/url_scanner_ex.c"
+yy13:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy25:
+yy14:
 	if (yybm[0+yych] & 128) {
-		goto yy24;
+		goto yy13;
 	}
-	goto yy21;
+	goto yy10;
 }
-#line 322 "ext/standard/url_scanner_ex.re"
+#line 527 "ext/standard/url_scanner_ex.re"
 
 
 state_next_arg_begin:
@@ -515,7 +654,7 @@ state_next_arg_begin:
 state_next_arg:
 	start = YYCURSOR;
 
-#line 519 "ext/standard/url_scanner_ex.c"
+#line 658 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -556,76 +695,76 @@ state_next_arg:
 	yych = *YYCURSOR;
 	if (yych <= '.') {
 		if (yych <= '\f') {
-			if (yych <= 0x08) goto yy36;
-			if (yych <= '\v') goto yy32;
-			goto yy36;
+			if (yych <= 0x08) goto yy25;
+			if (yych <= '\v') goto yy21;
+			goto yy25;
 		} else {
-			if (yych <= '\r') goto yy32;
-			if (yych == ' ') goto yy32;
-			goto yy36;
+			if (yych <= '\r') goto yy21;
+			if (yych == ' ') goto yy21;
+			goto yy25;
 		}
 	} else {
 		if (yych <= '@') {
-			if (yych <= '/') goto yy28;
-			if (yych == '>') goto yy30;
-			goto yy36;
+			if (yych <= '/') goto yy17;
+			if (yych == '>') goto yy19;
+			goto yy25;
 		} else {
-			if (yych <= 'Z') goto yy34;
-			if (yych <= '`') goto yy36;
-			if (yych <= 'z') goto yy34;
-			goto yy36;
+			if (yych <= 'Z') goto yy23;
+			if (yych <= '`') goto yy25;
+			if (yych <= 'z') goto yy23;
+			goto yy25;
 		}
 	}
-yy28:
+yy17:
 	++YYCURSOR;
-	if ((yych = *YYCURSOR) == '>') goto yy39;
-yy29:
-#line 333 "ext/standard/url_scanner_ex.re"
+	if ((yych = *YYCURSOR) == '>') goto yy28;
+yy18:
+#line 538 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); goto state_plain_begin; }
-#line 586 "ext/standard/url_scanner_ex.c"
-yy30:
+#line 725 "ext/standard/url_scanner_ex.c"
+yy19:
 	++YYCURSOR;
-yy31:
-#line 330 "ext/standard/url_scanner_ex.re"
+yy20:
+#line 535 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); handle_form(STD_ARGS); goto state_plain_begin; }
-#line 592 "ext/standard/url_scanner_ex.c"
-yy32:
+#line 731 "ext/standard/url_scanner_ex.c"
+yy21:
 	++YYCURSOR;
 	yych = *YYCURSOR;
-	goto yy38;
-yy33:
-#line 331 "ext/standard/url_scanner_ex.re"
+	goto yy27;
+yy22:
+#line 536 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); goto state_next_arg; }
-#line 600 "ext/standard/url_scanner_ex.c"
-yy34:
+#line 739 "ext/standard/url_scanner_ex.c"
+yy23:
 	++YYCURSOR;
-#line 332 "ext/standard/url_scanner_ex.re"
+#line 537 "ext/standard/url_scanner_ex.re"
 	{ --YYCURSOR; STATE = STATE_ARG; goto state_arg; }
-#line 605 "ext/standard/url_scanner_ex.c"
-yy36:
+#line 744 "ext/standard/url_scanner_ex.c"
+yy25:
 	yych = *++YYCURSOR;
-	goto yy29;
-yy37:
+	goto yy18;
+yy26:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy38:
+yy27:
 	if (yybm[0+yych] & 128) {
-		goto yy37;
+		goto yy26;
 	}
-	goto yy33;
-yy39:
+	goto yy22;
+yy28:
 	++YYCURSOR;
 	yych = *YYCURSOR;
-	goto yy31;
+	goto yy20;
 }
-#line 334 "ext/standard/url_scanner_ex.re"
+#line 539 "ext/standard/url_scanner_ex.re"
 
 
 state_arg:
 	start = YYCURSOR;
 
-#line 629 "ext/standard/url_scanner_ex.c"
+#line 768 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -664,40 +803,40 @@ state_arg:
 	};
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
-	if (yych <= '@') goto yy44;
-	if (yych <= 'Z') goto yy42;
-	if (yych <= '`') goto yy44;
-	if (yych >= '{') goto yy44;
-yy42:
+	if (yych <= '@') goto yy33;
+	if (yych <= 'Z') goto yy31;
+	if (yych <= '`') goto yy33;
+	if (yych >= '{') goto yy33;
+yy31:
 	++YYCURSOR;
 	yych = *YYCURSOR;
-	goto yy47;
-yy43:
-#line 339 "ext/standard/url_scanner_ex.re"
+	goto yy36;
+yy32:
+#line 544 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); handle_arg(STD_ARGS); STATE = STATE_BEFORE_VAL; goto state_before_val; }
-#line 679 "ext/standard/url_scanner_ex.c"
-yy44:
+#line 818 "ext/standard/url_scanner_ex.c"
+yy33:
 	++YYCURSOR;
-#line 340 "ext/standard/url_scanner_ex.re"
+#line 545 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); STATE = STATE_NEXT_ARG; goto state_next_arg; }
-#line 684 "ext/standard/url_scanner_ex.c"
-yy46:
+#line 823 "ext/standard/url_scanner_ex.c"
+yy35:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy47:
+yy36:
 	if (yybm[0+yych] & 128) {
-		goto yy46;
+		goto yy35;
 	}
-	goto yy43;
+	goto yy32;
 }
-#line 341 "ext/standard/url_scanner_ex.re"
+#line 546 "ext/standard/url_scanner_ex.re"
 
 
 state_before_val:
 	start = YYCURSOR;
 
-#line 701 "ext/standard/url_scanner_ex.c"
+#line 840 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -736,54 +875,54 @@ state_before_val:
 	};
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
-	if (yych == ' ') goto yy50;
-	if (yych == '=') goto yy52;
-	goto yy54;
-yy50:
+	if (yych == ' ') goto yy39;
+	if (yych == '=') goto yy41;
+	goto yy43;
+yy39:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ' ') goto yy57;
-	if (yych == '=') goto yy55;
-yy51:
-#line 347 "ext/standard/url_scanner_ex.re"
+	if (yych == ' ') goto yy46;
+	if (yych == '=') goto yy44;
+yy40:
+#line 552 "ext/standard/url_scanner_ex.re"
 	{ --YYCURSOR; goto state_next_arg_begin; }
-#line 750 "ext/standard/url_scanner_ex.c"
-yy52:
+#line 889 "ext/standard/url_scanner_ex.c"
+yy41:
 	++YYCURSOR;
 	yych = *YYCURSOR;
-	goto yy56;
-yy53:
-#line 346 "ext/standard/url_scanner_ex.re"
+	goto yy45;
+yy42:
+#line 551 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); STATE = STATE_VAL; goto state_val; }
-#line 758 "ext/standard/url_scanner_ex.c"
-yy54:
+#line 897 "ext/standard/url_scanner_ex.c"
+yy43:
 	yych = *++YYCURSOR;
-	goto yy51;
-yy55:
+	goto yy40;
+yy44:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy56:
+yy45:
 	if (yybm[0+yych] & 128) {
-		goto yy55;
+		goto yy44;
 	}
-	goto yy53;
-yy57:
+	goto yy42;
+yy46:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-	if (yych == ' ') goto yy57;
-	if (yych == '=') goto yy55;
+	if (yych == ' ') goto yy46;
+	if (yych == '=') goto yy44;
 	YYCURSOR = YYMARKER;
-	goto yy51;
+	goto yy40;
 }
-#line 348 "ext/standard/url_scanner_ex.re"
+#line 553 "ext/standard/url_scanner_ex.re"
 
 
 
 state_val:
 	start = YYCURSOR;
 
-#line 787 "ext/standard/url_scanner_ex.c"
+#line 926 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -824,85 +963,85 @@ state_val:
 	yych = *YYCURSOR;
 	if (yych <= ' ') {
 		if (yych <= '\f') {
-			if (yych <= 0x08) goto yy65;
-			if (yych <= '\n') goto yy67;
-			goto yy65;
+			if (yych <= 0x08) goto yy54;
+			if (yych <= '\n') goto yy56;
+			goto yy54;
 		} else {
-			if (yych <= '\r') goto yy67;
-			if (yych <= 0x1F) goto yy65;
-			goto yy67;
+			if (yych <= '\r') goto yy56;
+			if (yych <= 0x1F) goto yy54;
+			goto yy56;
 		}
 	} else {
 		if (yych <= '&') {
-			if (yych != '"') goto yy65;
+			if (yych != '"') goto yy54;
 		} else {
-			if (yych <= '\'') goto yy64;
-			if (yych == '>') goto yy67;
-			goto yy65;
+			if (yych <= '\'') goto yy53;
+			if (yych == '>') goto yy56;
+			goto yy54;
 		}
 	}
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych != '>') goto yy76;
-yy63:
-#line 357 "ext/standard/url_scanner_ex.re"
+	if (yych != '>') goto yy65;
+yy52:
+#line 562 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); goto state_next_arg_begin; }
-#line 850 "ext/standard/url_scanner_ex.c"
-yy64:
+#line 989 "ext/standard/url_scanner_ex.c"
+yy53:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == '>') goto yy63;
-	goto yy71;
-yy65:
+	if (yych == '>') goto yy52;
+	goto yy60;
+yy54:
 	++YYCURSOR;
 	yych = *YYCURSOR;
-	goto yy69;
-yy66:
-#line 356 "ext/standard/url_scanner_ex.re"
+	goto yy58;
+yy55:
+#line 561 "ext/standard/url_scanner_ex.re"
 	{ handle_val(STD_ARGS, 0, ' '); goto state_next_arg_begin; }
-#line 862 "ext/standard/url_scanner_ex.c"
-yy67:
+#line 1001 "ext/standard/url_scanner_ex.c"
+yy56:
 	yych = *++YYCURSOR;
-	goto yy63;
-yy68:
+	goto yy52;
+yy57:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy69:
+yy58:
 	if (yybm[0+yych] & 32) {
-		goto yy68;
+		goto yy57;
 	}
-	goto yy66;
-yy70:
+	goto yy55;
+yy59:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy71:
+yy60:
 	if (yybm[0+yych] & 64) {
-		goto yy70;
+		goto yy59;
 	}
-	if (yych <= '=') goto yy73;
-yy72:
+	if (yych <= '\'') goto yy62;
+yy61:
 	YYCURSOR = YYMARKER;
-	goto yy63;
-yy73:
+	goto yy52;
+yy62:
 	++YYCURSOR;
-#line 355 "ext/standard/url_scanner_ex.re"
+#line 560 "ext/standard/url_scanner_ex.re"
 	{ handle_val(STD_ARGS, 1, '\''); goto state_next_arg_begin; }
-#line 891 "ext/standard/url_scanner_ex.c"
-yy75:
+#line 1030 "ext/standard/url_scanner_ex.c"
+yy64:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy76:
+yy65:
 	if (yybm[0+yych] & 128) {
-		goto yy75;
+		goto yy64;
 	}
-	if (yych >= '>') goto yy72;
+	if (yych >= '#') goto yy61;
 	++YYCURSOR;
-#line 354 "ext/standard/url_scanner_ex.re"
+#line 559 "ext/standard/url_scanner_ex.re"
 	{ handle_val(STD_ARGS, 1, '"'); goto state_next_arg_begin; }
-#line 904 "ext/standard/url_scanner_ex.c"
+#line 1043 "ext/standard/url_scanner_ex.c"
 }
-#line 358 "ext/standard/url_scanner_ex.re"
+#line 563 "ext/standard/url_scanner_ex.re"
 
 
 stop:
@@ -919,7 +1058,7 @@ stop:
 }
 
 
-PHPAPI char *php_url_scanner_adapt_single_url(const char *url, size_t urllen, const char *name, const char *value, size_t *newlen, int urlencode)
+PHPAPI char *php_url_scanner_adapt_single_url(const char *url, size_t urllen, const char *name, const char *value, size_t *newlen, int encode)
 {
 	char *result;
 	smart_str surl = {0};
@@ -929,7 +1068,7 @@ PHPAPI char *php_url_scanner_adapt_single_url(const char *url, size_t urllen, co
 
 	smart_str_appendl(&surl, url, urllen);
 
-	if (urlencode) {
+	if (encode) {
 		encoded = php_raw_url_encode(name, strlen(name));
 		smart_str_appendl(&url_app, ZSTR_VAL(encoded), ZSTR_LEN(encoded));
 		zend_string_free(encoded);
@@ -937,7 +1076,7 @@ PHPAPI char *php_url_scanner_adapt_single_url(const char *url, size_t urllen, co
 		smart_str_appends(&url_app, name);
 	}
 	smart_str_appendc(&url_app, '=');
-	if (urlencode) {
+	if (encode) {
 		encoded = php_raw_url_encode(value, strlen(value));
 		smart_str_appendl(&url_app, ZSTR_VAL(encoded), ZSTR_LEN(encoded));
 		zend_string_free(encoded);
@@ -958,13 +1097,10 @@ PHPAPI char *php_url_scanner_adapt_single_url(const char *url, size_t urllen, co
 }
 
 
-static char *url_adapt_ext(const char *src, size_t srclen, size_t *newlen, zend_bool do_flush)
+static char *url_adapt_ext(const char *src, size_t srclen, size_t *newlen, zend_bool do_flush, url_adapt_state_ex_t *ctx)
 {
-	url_adapt_state_ex_t *ctx;
 	char *retval;
 
-	ctx = &BG(url_adapt_state_ex);
-
 	xx_mainloop(ctx, src, srclen);
 
 	if (!ctx->result.s) {
@@ -979,50 +1115,67 @@ static char *url_adapt_ext(const char *src, size_t srclen, size_t *newlen, zend_
 		*newlen += ZSTR_LEN(ctx->buf.s);
 		smart_str_free(&ctx->buf);
 		smart_str_free(&ctx->val);
+		smart_str_free(&ctx->attr_val);
 	}
 	retval = estrndup(ZSTR_VAL(ctx->result.s), ZSTR_LEN(ctx->result.s));
 	smart_str_free(&ctx->result);
 	return retval;
 }
 
-static int php_url_scanner_ex_activate(void)
+static int php_url_scanner_ex_activate(int type)
 {
 	url_adapt_state_ex_t *ctx;
 
-	ctx = &BG(url_adapt_state_ex);
+	if (type) {
+		ctx = &BG(url_adapt_session_ex);
+	} else {
+		ctx = &BG(url_adapt_output_ex);
+	}
 
 	memset(ctx, 0, ((size_t) &((url_adapt_state_ex_t *)0)->tags));
 
 	return SUCCESS;
 }
 
-static int php_url_scanner_ex_deactivate(void)
+static int php_url_scanner_ex_deactivate(int type)
 {
 	url_adapt_state_ex_t *ctx;
 
-	ctx = &BG(url_adapt_state_ex);
+	if (type) {
+		ctx = &BG(url_adapt_session_ex);
+	} else {
+		ctx = &BG(url_adapt_output_ex);
+	}
 
 	smart_str_free(&ctx->result);
 	smart_str_free(&ctx->buf);
 	smart_str_free(&ctx->tag);
 	smart_str_free(&ctx->arg);
+	smart_str_free(&ctx->attr_val);
 
 	return SUCCESS;
 }
 
-static void php_url_scanner_output_handler(char *output, size_t output_len, char **handled_output, size_t *handled_output_len, int mode)
+static inline void php_url_scanner_session_handler_impl(char *output, size_t output_len, char **handled_output, size_t *handled_output_len, int mode, int type)
 {
 	size_t len;
+	url_adapt_state_ex_t *url_state;
 
-	if (ZSTR_LEN(BG(url_adapt_state_ex).url_app.s) != 0) {
-		*handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & (PHP_OUTPUT_HANDLER_END | PHP_OUTPUT_HANDLER_CONT | PHP_OUTPUT_HANDLER_FLUSH | PHP_OUTPUT_HANDLER_FINAL) ? 1 : 0));
+	if (type) {
+		url_state = &BG(url_adapt_session_ex);
+	} else {
+		url_state = &BG(url_adapt_output_ex);
+	}
+
+	if (ZSTR_LEN(url_state->url_app.s) != 0) {
+		*handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & (PHP_OUTPUT_HANDLER_END | PHP_OUTPUT_HANDLER_CONT | PHP_OUTPUT_HANDLER_FLUSH | PHP_OUTPUT_HANDLER_FINAL) ? 1 : 0), url_state);
 		if (sizeof(uint) < sizeof(size_t)) {
 			if (len > UINT_MAX)
 				len = UINT_MAX;
 		}
 		*handled_output_len = len;
-	} else if (ZSTR_LEN(BG(url_adapt_state_ex).url_app.s) == 0) {
-		url_adapt_state_ex_t *ctx = &BG(url_adapt_state_ex);
+	} else if (ZSTR_LEN(url_state->url_app.s) == 0) {
+		url_adapt_state_ex_t *ctx = url_state;
 		if (ctx->buf.s && ZSTR_LEN(ctx->buf.s)) {
 			smart_str_append(&ctx->result, ctx->buf.s);
 			smart_str_appendl(&ctx->result, output, output_len);
@@ -1040,67 +1193,267 @@ static void php_url_scanner_output_handler(char *output, size_t output_len, char
 	}
 }
 
-PHPAPI int php_url_scanner_add_var(char *name, size_t name_len, char *value, size_t value_len, int urlencode)
+static void php_url_scanner_session_handler(char *output, size_t output_len, char **handled_output, size_t *handled_output_len, int mode)
+{
+	php_url_scanner_session_handler_impl(output, output_len, handled_output, handled_output_len, mode, 1);
+}
+
+static void php_url_scanner_output_handler(char *output, size_t output_len, char **handled_output, size_t *handled_output_len, int mode)
+{
+	php_url_scanner_session_handler_impl(output, output_len, handled_output, handled_output_len, mode, 0);
+}
+
+static inline int php_url_scanner_add_var_impl(char *name, size_t name_len, char *value, size_t value_len, int encode, int type)
 {
 	smart_str sname = {0};
 	smart_str svalue = {0};
+	smart_str hname = {0};
+	smart_str hvalue = {0};
 	zend_string *encoded;
+	url_adapt_state_ex_t *url_state;
+	php_output_handler_func_t handler;
+
+	if (type) {
+		url_state = &BG(url_adapt_session_ex);
+		handler = php_url_scanner_session_handler;
+	} else {
+		url_state = &BG(url_adapt_output_ex);
+		handler = php_url_scanner_output_handler;
+	}
 
-	if (!BG(url_adapt_state_ex).active) {
-		php_url_scanner_ex_activate();
-		php_output_start_internal(ZEND_STRL("URL-Rewriter"), php_url_scanner_output_handler, 0, PHP_OUTPUT_HANDLER_STDFLAGS);
-		BG(url_adapt_state_ex).active = 1;
+	if (!url_state->active) {
+		php_url_scanner_ex_activate(type);
+		php_output_start_internal(ZEND_STRL("URL-Rewriter"), handler, 0, PHP_OUTPUT_HANDLER_STDFLAGS);
+		url_state->active = 1;
 	}
 
-	if (BG(url_adapt_state_ex).url_app.s && ZSTR_LEN(BG(url_adapt_state_ex).url_app.s) != 0) {
-		smart_str_appends(&BG(url_adapt_state_ex).url_app, PG(arg_separator).output);
+	if (url_state->url_app.s && ZSTR_LEN(url_state->url_app.s) != 0) {
+		smart_str_appends(&url_state->url_app, PG(arg_separator).output);
 	}
 
-	if (urlencode) {
+	if (encode) {
 		encoded = php_raw_url_encode(name, name_len);
-		smart_str_appendl(&sname, ZSTR_VAL(encoded), ZSTR_LEN(encoded));
-		zend_string_free(encoded);
+		smart_str_appendl(&sname, ZSTR_VAL(encoded), ZSTR_LEN(encoded)); zend_string_free(encoded);
 		encoded = php_raw_url_encode(value, value_len);
-		smart_str_appendl(&svalue, ZSTR_VAL(encoded), ZSTR_LEN(encoded));
-		zend_string_free(encoded);
+		smart_str_appendl(&svalue, ZSTR_VAL(encoded), ZSTR_LEN(encoded)); zend_string_free(encoded);
+		encoded = php_escape_html_entities_ex((unsigned char*)name, name_len, 0, ENT_QUOTES|ENT_SUBSTITUTE, SG(default_charset), 0);
+		smart_str_appendl(&hname, ZSTR_VAL(encoded), ZSTR_LEN(encoded)); zend_string_free(encoded);
+		encoded = php_escape_html_entities_ex((unsigned char*)value, value_len, 0, ENT_QUOTES|ENT_SUBSTITUTE, SG(default_charset), 0);
+		smart_str_appendl(&hvalue, ZSTR_VAL(encoded), ZSTR_LEN(encoded)); zend_string_free(encoded);
 	} else {
 		smart_str_appendl(&sname, name, name_len);
 		smart_str_appendl(&svalue, value, value_len);
+		smart_str_appendl(&hname, name, name_len);
+		smart_str_appendl(&hvalue, value, value_len);
 	}
 
-	smart_str_append_smart_str(&BG(url_adapt_state_ex).url_app, &sname);
-	smart_str_appendc(&BG(url_adapt_state_ex).url_app, '=');
-	smart_str_append_smart_str(&BG(url_adapt_state_ex).url_app, &svalue);
+	smart_str_append_smart_str(&url_state->url_app, &sname);
+	smart_str_appendc(&url_state->url_app, '=');
+	smart_str_append_smart_str(&url_state->url_app, &svalue);
 
-	smart_str_appends(&BG(url_adapt_state_ex).form_app, "<input type=\"hidden\" name=\"");
-	smart_str_append_smart_str(&BG(url_adapt_state_ex).form_app, &sname);
-	smart_str_appends(&BG(url_adapt_state_ex).form_app, "\" value=\"");
-	smart_str_append_smart_str(&BG(url_adapt_state_ex).form_app, &svalue);
-	smart_str_appends(&BG(url_adapt_state_ex).form_app, "\" />");
+	smart_str_appends(&url_state->form_app, "<input type=\"hidden\" name=\"");
+	smart_str_append_smart_str(&url_state->form_app, &hname);
+	smart_str_appends(&url_state->form_app, "\" value=\"");
+	smart_str_append_smart_str(&url_state->form_app, &hvalue);
+	smart_str_appends(&url_state->form_app, "\" />");
 
 	smart_str_free(&sname);
 	smart_str_free(&svalue);
+	smart_str_free(&hname);
+	smart_str_free(&hvalue);
 
 	return SUCCESS;
 }
 
-PHPAPI int php_url_scanner_reset_vars(void)
+
+PHPAPI int php_url_scanner_add_session_var(char *name, size_t name_len, char *value, size_t value_len, int encode)
+{
+	return php_url_scanner_add_var_impl(name, name_len, value, value_len, encode, 1);
+}
+
+
+PHPAPI int php_url_scanner_add_var(char *name, size_t name_len, char *value, size_t value_len, int encode)
 {
-	if (BG(url_adapt_state_ex).form_app.s) {
-		ZSTR_LEN(BG(url_adapt_state_ex).form_app.s) = 0;
+	return php_url_scanner_add_var_impl(name, name_len, value, value_len, encode, 0);
+}
+
+
+static inline void php_url_scanner_reset_vars_impl(int type) {
+	url_adapt_state_ex_t *url_state;
+
+	if (type) {
+		url_state = &BG(url_adapt_session_ex);
+	} else {
+		url_state = &BG(url_adapt_output_ex);
 	}
-	if (BG(url_adapt_state_ex).url_app.s) {
-		ZSTR_LEN(BG(url_adapt_state_ex).url_app.s) = 0;
+
+	if (url_state->form_app.s) {
+		ZSTR_LEN(url_state->form_app.s) = 0;
+	}
+	if (url_state->url_app.s) {
+		ZSTR_LEN(url_state->url_app.s) = 0;
 	}
+}
+
 
+PHPAPI int php_url_scanner_reset_session_vars(void)
+{
+	php_url_scanner_reset_vars_impl(1);
 	return SUCCESS;
 }
 
+
+PHPAPI int php_url_scanner_reset_vars(void)
+{
+	php_url_scanner_reset_vars_impl(0);
+	return SUCCESS;
+}
+
+
+static inline int php_url_scanner_reset_var_impl(zend_string *name, int encode, int type)
+{
+	char *start, *end, *limit;
+	size_t separator_len;
+	smart_str sname = {0};
+	smart_str hname = {0};
+	smart_str url_app = {0};
+	smart_str form_app = {0};
+	zend_string *encoded;
+	int ret = SUCCESS;
+	zend_bool sep_removed = 0;
+	url_adapt_state_ex_t *url_state;
+
+	if (type) {
+		url_state = &BG(url_adapt_session_ex);
+	} else {
+		url_state = &BG(url_adapt_output_ex);
+	}
+
+	/* Short circuit check. Only check url_app. */
+	if (!url_state->url_app.s || !ZSTR_LEN(url_state->url_app.s)) {
+		return SUCCESS;
+	}
+
+	if (encode) {
+		encoded = php_raw_url_encode(ZSTR_VAL(name), ZSTR_LEN(name));
+		smart_str_appendl(&sname, ZSTR_VAL(encoded), ZSTR_LEN(encoded));
+		zend_string_free(encoded);
+		encoded = php_escape_html_entities_ex((unsigned char *)ZSTR_VAL(name), ZSTR_LEN(name), 0, ENT_QUOTES|ENT_SUBSTITUTE, SG(default_charset), 0);
+		smart_str_appendl(&hname, ZSTR_VAL(encoded), ZSTR_LEN(encoded));
+		zend_string_free(encoded);
+	} else {
+		smart_str_appendl(&sname, ZSTR_VAL(name), ZSTR_LEN(name));
+		smart_str_appendl(&hname, ZSTR_VAL(name), ZSTR_LEN(name));
+	}
+	smart_str_0(&sname);
+	smart_str_0(&hname);
+
+	smart_str_append_smart_str(&url_app, &sname);
+	smart_str_appendc(&url_app, '=');
+	smart_str_0(&url_app);
+
+	smart_str_appends(&form_app, "<input type=\"hidden\" name=\"");
+	smart_str_append_smart_str(&form_app, &hname);
+	smart_str_appends(&form_app, "\" value=\"");
+	smart_str_0(&form_app);
+
+	/* Short circuit check. Only check url_app. */
+	start = (char *) php_memnstr(ZSTR_VAL(url_state->url_app.s),
+								 ZSTR_VAL(url_app.s), ZSTR_LEN(url_app.s),
+								 ZSTR_VAL(url_state->url_app.s) + ZSTR_LEN(url_state->url_app.s));
+	if (!start) {
+		ret = FAILURE;
+		goto finish;
+	}
+
+	/* Get end of url var */
+	limit = ZSTR_VAL(url_state->url_app.s) + ZSTR_LEN(url_state->url_app.s);
+	end = start + ZSTR_LEN(url_app.s);
+	separator_len = strlen(PG(arg_separator).output);
+	while (end < limit) {
+		if (!memcmp(end, PG(arg_separator).output, separator_len)) {
+			end += separator_len;
+			sep_removed = 1;
+			break;
+		}
+		end++;
+	}
+	/* Remove all when this is the only rewrite var */
+	if (ZSTR_LEN(url_state->url_app.s) == end - start) {
+		php_url_scanner_reset_vars_impl(type);
+		goto finish;
+	}
+	/* Check preceeding separator */
+	if (!sep_removed
+		&& start - PG(arg_separator).output >= separator_len
+		&& !memcmp(start - separator_len, PG(arg_separator).output, separator_len)) {
+		start -= separator_len;
+	}
+	/* Remove partially */
+	memmove(start, end,
+			ZSTR_LEN(url_state->url_app.s) - (end - ZSTR_VAL(url_state->url_app.s)));
+	ZSTR_LEN(url_state->url_app.s) -= end - start;
+	ZSTR_VAL(url_state->url_app.s)[ZSTR_LEN(url_state->url_app.s)] = '\0';
+
+	/* Remove form var */
+	start = (char *) php_memnstr(ZSTR_VAL(url_state->form_app.s),
+						ZSTR_VAL(form_app.s), ZSTR_LEN(form_app.s),
+						ZSTR_VAL(url_state->form_app.s) + ZSTR_LEN(url_state->form_app.s));
+	if (!start) {
+		/* Should not happen */
+		ret = FAILURE;
+		php_url_scanner_reset_vars_impl(type);
+		goto finish;
+	}
+	/* Get end of form var */
+	limit = ZSTR_VAL(url_state->form_app.s) + ZSTR_LEN(url_state->form_app.s);
+	end = start + ZSTR_LEN(form_app.s);
+	while (end < limit) {
+		if (*end == '>') {
+			end += 1;
+			break;
+		}
+		end++;
+	}
+	/* Remove partially */
+	memmove(start, end,
+			ZSTR_LEN(url_state->form_app.s) - (end - ZSTR_VAL(url_state->form_app.s)));
+	ZSTR_LEN(url_state->form_app.s) -= end - start;
+	ZSTR_VAL(url_state->form_app.s)[ZSTR_LEN(url_state->form_app.s)] = '\0';
+
+finish:
+	smart_str_free(&url_app);
+	smart_str_free(&form_app);
+	smart_str_free(&sname);
+	smart_str_free(&hname);
+	return ret;
+}
+
+
+PHPAPI int php_url_scanner_reset_session_var(zend_string *name, int encode)
+{
+	return php_url_scanner_reset_var_impl(name, encode, 1);
+}
+
+
+PHPAPI int php_url_scanner_reset_var(zend_string *name, int encode)
+{
+	return php_url_scanner_reset_var_impl(name, encode, 0);
+}
+
+
 PHP_MINIT_FUNCTION(url_scanner)
 {
-	BG(url_adapt_state_ex).tags = NULL;
+	BG(url_adapt_session_ex).tags = NULL;
+	BG(url_adapt_session_ex).form_app.s = BG(url_adapt_session_ex).url_app.s = NULL;
+	zend_hash_init(&BG(url_adapt_session_hosts_ht), 0, NULL, NULL, 1);
 
-	BG(url_adapt_state_ex).form_app.s = BG(url_adapt_state_ex).url_app.s = NULL;
+	BG(url_adapt_output_ex).tags = NULL;
+	BG(url_adapt_output_ex).form_app.s = BG(url_adapt_output_ex).url_app.s = NULL;
+	zend_hash_init(&BG(url_adapt_output_hosts_ht), 0, NULL, NULL, 1);
+
+	BG(url_adapt_session_ex).type = 1;
+	BG(url_adapt_output_ex).type  = 0;
 
 	REGISTER_INI_ENTRIES();
 	return SUCCESS;
@@ -1115,20 +1468,34 @@ PHP_MSHUTDOWN_FUNCTION(url_scanner)
 
 PHP_RINIT_FUNCTION(url_scanner)
 {
-	BG(url_adapt_state_ex).active = 0;
-
+	BG(url_adapt_session_ex).active    = 0;
+	BG(url_adapt_session_ex).tag_type  = 0;
+	BG(url_adapt_session_ex).attr_type = 0;
+	BG(url_adapt_output_ex).active    = 0;
+	BG(url_adapt_output_ex).tag_type  = 0;
+	BG(url_adapt_output_ex).attr_type = 0;
 	return SUCCESS;
 }
 
 PHP_RSHUTDOWN_FUNCTION(url_scanner)
 {
-	if (BG(url_adapt_state_ex).active) {
-		php_url_scanner_ex_deactivate();
-		BG(url_adapt_state_ex).active = 0;
+	if (BG(url_adapt_session_ex).active) {
+		php_url_scanner_ex_deactivate(1);
+		BG(url_adapt_session_ex).active    = 0;
+		BG(url_adapt_session_ex).tag_type  = 0;
+		BG(url_adapt_session_ex).attr_type = 0;
 	}
-
-	smart_str_free(&BG(url_adapt_state_ex).form_app);
-	smart_str_free(&BG(url_adapt_state_ex).url_app);
+	smart_str_free(&BG(url_adapt_session_ex).form_app);
+	smart_str_free(&BG(url_adapt_session_ex).url_app);
+
+	if (BG(url_adapt_output_ex).active) {
+		php_url_scanner_ex_deactivate(0);
+		BG(url_adapt_output_ex).active    = 0;
+		BG(url_adapt_output_ex).tag_type  = 0;
+		BG(url_adapt_output_ex).attr_type = 0;
+	}
+	smart_str_free(&BG(url_adapt_output_ex).form_app);
+	smart_str_free(&BG(url_adapt_output_ex).url_app);
 
 	return SUCCESS;
 }