sanitize request string

src/Controller/Nex.php

@@ -82,7 +82,10 @@ class Nex implements MessageComponentInterface
 
         // Filter request
         $request = trim(
-            $request
+            filter_var(
+                $request,
+                FILTER_SANITIZE_URL
+            )
         );
 
         // Build absolute realpath
@@ -165,16 +168,8 @@ class Nex implements MessageComponentInterface
                         (string) date('c'),
                         (string) $connection->remoteAddress,
                         (string) $connection->resourceId,
-                        (string) str_replace(
+                        (string) $request,
-                            '%',
+                        (string) $realpath,
-                            '%%',
-                            $request
-                        ),
-                        (string) str_replace(
-                            '%',
-                            '%%',
-                            $realpath
-                        ),
                         (string) mb_strlen(
                             $response
                         )