    public function redirect($url)
    {
        if (trim($url) == '') {
            return false;
        }

        $url = str_ireplace('Location:', '', $url);
        $url = trim($url);

        $redirectUrl = site_url();
        $parseUrl = parse_url($url);
        if (isset($parseUrl['host'])) {
            if ($parseUrl['host'] == site_hostname()) {
                $redirectUrl = $url;
            }
        }

        $redirectUrl = str_replace("\r", "", $redirectUrl);
        $redirectUrl = str_replace("\n", "", $redirectUrl);

        $clearInput = new HTMLClean();
        $redirectUrl = $clearInput->clean($redirectUrl);

        if (headers_sent()) {
            echo '<meta http-equiv="refresh" content="0;url=' . $redirectUrl . '">';
        } else {
            return \Redirect::to($redirectUrl);
        }
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.