bugfix:

function string_sanitize_url( $p_url ) {
    $t_url = $p_url;
    if ( preg_match( '?http(s)*://?', $t_url ) > 0 ) { 
        // no embedded addresses
        if ( preg_match( '?^' . config_get( 'path' ) . '?', $t_url ) == 0 ) { 
            // url is ok if it begins with our path, if not, replace it
            $t_url = 'index.php';
        }
    } else if ( $t_url == '' ) {
        $t_url = 'index.php';
    }

    // split and encode parameters
    if ( strpos( $t_url, '?' ) !== FALSE ) {
        list( $t_path, $t_param ) = split( '\?', $t_url, 2 );
        if ( $t_param !== "" ) {
            $t_vals = array();
            $t_param = str_replace( '?','', $t_param );
            parse_str( $t_param, $t_vals );
            $t_param = '';
            $count = 0;
            foreach($t_vals as $k => $v) {
                if ($count++ > 0) {
                    $t_param .= '&'; 
                }
                $t_param .= "$k=" . urlencode( strip_tags( urldecode( $v ) ) );
            }
            return $t_path . '?' . $t_param;
        } else {
            return $t_path;
        }
    } else {
        return $t_url;
    }
}

Fixed in CVS.

core/string_api.php -> 1.81