obscure bug in home_url

[adelval]

Try this:

echo home_url('?key=f..1').'<br />';
echo home_url().'/?key=f..1');

The former prints only the home url - the argument is ignored or silently consumed. The latter gives the correct result, and the browser doesn't complain about the resulting address (so I assume it's a valid url?)

The issue arised in a situation where we use a key generated with wp_hash_password, and one of the keys had those two consecutive dots.

[ocean90]

Duplicate of #19032.