html information exceeds domain length after being hex-sanitized

the problem can't tell user characters certified domain since transient value some-more characters unescaped one.

i few solutions, nonetheless zero looks unequivocally good:

• one whitelist any domain (too many work doesn't definitely solve problem)


• one blacklist any domain (same above)


• use domain length reason information even characters transient (bad)


• uncap distance database domain (worse)


• save information hex-unescaped pass accountability wholly cost filtering (not unequivocally good)


• let user speculation border distance (worst)

are there options? there "best practice" case?

sample code:

$string = 'javascript:alert("hello!");';
echo strlen($string);
// outputs 27
$escaped_string = filter_var('javascript:alert("hello!");', filter_sanitize_encoded);
echo strlen($escaped_string);
// outputs 41

if length database domain is, say, 40, transient information fit.