The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.

Merged pull 1607 back to 5.6.

Hi, 

I wrote 
```
Expected result:
----------------
parse_url("http://example.com:80#@google.com/")["host"];

example.com or parse error
```

but, recognized # as end of authority component and 
same as http://example.com:80/#@google.com/ is more correct.

   The authority component is preceded by a double slash ("//") and is
   terminated by the next slash ("/"), question mark ("?"), or number
   sign ("#") character, or by the end of the URI.


in PHP 7.1.0RC3, can't parse these url.

php > $result = parse_url("http://example.com:80#@google.com/"); echo $result == null;
1

please review again.

I'm not sure I understand you comment. If you have better fix, please suggest it here or make pull request. If you have scenario which should be handled better, please provide:
1. Reproducing script
2. Expected output
3. Actual output

1. Reproducing script
php > var_dump(parse_url("http://example.com:80#@google.com/"));

2. Expected output

array(4) {
  ["scheme"]=>
  string(4) "http"
  ["host"]=>
  string(11) "example.com"
  ["port"]=>
  int(80)
  ["fragment"]=>
  string(12) "@google.com/"
}

3. Actual output

in PHP 7.1
bool(false)

in PHP 5.5
php > var_dump(parse_url("http://example.com:80#@google.com/"));
array(5) {
  ["scheme"]=>
  string(4) "http"
  ["host"]=>
  string(10) "google.com"
  ["user"]=>
  string(11) "example.com"
  ["pass"]=>
  string(3) "80#"
  ["path"]=>
  string(1) "/"
}

ping @nikic

I can't find this fix in release note of 5.6.28 and 7.0.13.

https://github.com/php/php-src/commit/c8ff491106f1bdb9f0c62875f52d51cfb461eb5d
https://github.com/php/php-src/commit/7bded39b2fc14c5a181a93a57bc23af858b585f6

This is security issue.
I think CVE-ID should be assigned.

for example, 

cURL's case
CVE-2016-8624 
https://curl.haxx.se/docs/adv_20161102J.html

see WordPress's ugly workaround code.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2221
https://core.trac.wordpress.org/changeset/36444

@mala thanks for checking, the revision b061fa909de77085d3822a89ab901b934d0362c4 is in the upcoming releases, merely it's missing in the NEWS. The final changelog will contain the entry.

Thanks.

With this fix in php 5.6.28, I have some code that no long works.  The ftp urls contain a username which is in fact an email address and a pw that has symbols.  Then parse_url returns false.  It used to work before this fix (before 5.6.28).

test url:
ftp://[email protected]:passwordhassymbols$%[email protected]/

test case:
echo print_r(parse_url("ftp://[email protected]:passwordhassymbols$%[email protected]/"), true);
Should return an array with url elements.