fix xss in send_to

fixing a major security vulnerability which allowed attackers to execute javascript via the send_to parameter

app-code/api/login/redirect.php

@@ -5,7 +5,7 @@ header('Content-Type: application/json');
 include "../utils/get_location.php";
 
 $send_to=$_SESSION["end_url"];
-
+$send_to = htmlspecialchars(str_replace([':', ';', 'script', 'java','(',')'],'',$send_to));
 include "../../config/config.php";
 $conn = new mysqli($DB_SERVERNAME, $DB_USERNAME, $DB_PASSWORD, $DB_DATABASE);