Fix OpenURL on SDL (#3460)

src/platforms/rcore_desktop_sdl.c

@@ -893,9 +893,15 @@ double GetTime(void)
 }
 
 // Open URL with default system browser (if available)
+// NOTE: This function is only safe to use if you control the URL given.
+// A user could craft a malicious string performing another action.
+// Only call this function yourself not with user input or make sure to check the string yourself.
+// Ref: https://github.com/raysan5/raylib/issues/686
 void OpenURL(const char *url)
 {
-    SDL_OpenURL(url);
+    // Security check to (partially) avoid malicious code
+    if (strchr(url, '\'') != NULL) TRACELOG(LOG_WARNING, "SYSTEM: Provided URL could be potentially malicious, avoid [\'] character");
+    else SDL_OpenURL(url);
 }
 
 //----------------------------------------------------------------------------------