diff --git a/src/parser/PhutilURI.php b/src/parser/PhutilURI.php
index feadb6c..392b358 100644
--- a/src/parser/PhutilURI.php
+++ b/src/parser/PhutilURI.php
@@ -1,161 +1,173 @@
 <?php
 
 /**
  * Basic URI parser object.
  *
  * @group util
  */
 final class PhutilURI {
 
   private $protocol;
   private $user;
   private $pass;
   private $domain;
   private $port;
   private $path;
   private $query = array();
   private $fragment;
 
   public function __construct($uri) {
     $parts = parse_url($uri);
+
+    // NOTE: `parse_url()` is very liberal about host names; fail the parse if
+    // the host looks like garbage.
     if ($parts) {
-      // stringyness is to preserve API compatibility and
-      // allow the tests to continue passing
-      $this->protocol = idx($parts, 'scheme', '');
-      $this->user     = idx($parts, 'user', '');
-      $this->pass     = idx($parts, 'pass', '');
-      $this->domain   = idx($parts, 'host', '');
-      $this->port     = (string)idx($parts, 'port', '');
-      $this->path     = idx($parts, 'path', '');
-      $query = idx($parts, 'query');
-      if ($query) {
-        parse_str($query, $this->query);
+      $host = idx($parts, 'host', '');
+      if (!preg_match('/^([a-zA-Z0-9\\.\\-]*)$/', $host)) {
+        $parts = false;
       }
-      $this->fragment = idx($parts, 'fragment', '');
     }
+
+    if (!$parts) {
+      $parts = array();
+    }
+
+    // stringyness is to preserve API compatibility and
+    // allow the tests to continue passing
+    $this->protocol = idx($parts, 'scheme', '');
+    $this->user     = idx($parts, 'user', '');
+    $this->pass     = idx($parts, 'pass', '');
+    $this->domain   = idx($parts, 'host', '');
+    $this->port     = (string)idx($parts, 'port', '');
+    $this->path     = idx($parts, 'path', '');
+    $query = idx($parts, 'query');
+    if ($query) {
+      parse_str($query, $this->query);
+    }
+    $this->fragment = idx($parts, 'fragment', '');
   }
 
   public function __toString() {
     $prefix = null;
     if ($this->protocol || $this->domain || $this->port) {
       $protocol = nonempty($this->protocol, 'http');
 
       $auth = '';
       if ($this->user && $this->pass) {
         $auth = $this->user.':'.$this->pass.'@';
       } else if ($this->user) {
         $auth = $this->user.'@';
       }
 
       $prefix = $protocol.'://'.$auth.$this->domain;
       if ($this->port) {
         $prefix .= ':'.$this->port;
       }
     }
 
     if ($this->query) {
       $query = '?'.http_build_query($this->query);
     } else {
       $query = null;
     }
 
     if (strlen($this->getFragment())) {
       $fragment = '#'.$this->getFragment();
     } else {
       $fragment = null;
     }
 
 
     return $prefix.$this->getPath().$query.$fragment;
   }
 
   public function setQueryParam($key, $value) {
     if ($value === null) {
       unset($this->query[$key]);
     } else {
       $this->query[$key] = $value;
     }
     return $this;
   }
 
   public function setQueryParams(array $params) {
     $this->query = $params;
     return $this;
   }
 
   public function getQueryParams() {
     return $this->query;
   }
 
   public function setProtocol($protocol) {
     $this->protocol = $protocol;
     return $this;
   }
   public function getProtocol() {
     return $this->protocol;
   }
 
   public function setDomain($domain) {
     $this->domain = $domain;
     return $this;
   }
 
   public function getDomain() {
     return $this->domain;
   }
 
   public function setPort($port) {
     $this->port = $port;
     return $this;
   }
   public function getPort() {
     return $this->port;
   }
 
   public function setPath($path) {
     if ($this->domain && strlen($path) && $path[0] !== '/') {
       $path = '/'.$path;
     }
     $this->path = $path;
     return $this;
   }
 
   public function getPath() {
     return $this->path;
   }
 
   public function setFragment($fragment) {
     $this->fragment = $fragment;
     return $this;
   }
 
   public function getFragment() {
     return $this->fragment;
   }
 
   public function setUser($user) {
     $this->user = $user;
     return $this;
   }
 
   public function getUser() {
     return $this->user;
   }
 
   public function setPass($pass) {
     $this->pass = $pass;
     return $this;
   }
 
   public function getPass() {
     return $this->pass;
   }
 
   public function alter($key, $value) {
     $altered = clone $this;
     $altered->setQueryParam($key, $value);
     return $altered;
   }
 
 }
 
diff --git a/src/parser/__tests__/PhutilURITestCase.php b/src/parser/__tests__/PhutilURITestCase.php
index 5e56f5c..919e596 100644
--- a/src/parser/__tests__/PhutilURITestCase.php
+++ b/src/parser/__tests__/PhutilURITestCase.php
@@ -1,55 +1,59 @@
 <?php
 
 /**
  * Test cases for @{class:PhutilURI} parser.
  *
  * @group testcase
  */
 final class PhutilURITestCase extends PhutilTestCase {
 
   public function testURIParsing() {
     $uri = new PhutilURI('http://user:pass@host:99/path/?query=value#fragment');
     $this->assertEqual('http', $uri->getProtocol(), 'protocol');
     $this->assertEqual('user', $uri->getUser(), 'user');
     $this->assertEqual('pass', $uri->getPass(), 'pass');
     $this->assertEqual('host', $uri->getDomain(), 'domain');
     $this->assertEqual('99', $uri->getPort(), 'port');
 
     $this->assertEqual('/path/', $uri->getPath(), 'path');
     $this->assertEqual(
       array(
         'query' => 'value',
       ),
       $uri->getQueryParams(),
       'query params');
     $this->assertEqual('fragment', $uri->getFragment(), 'fragment');
     $this->assertEqual(
       'http://user:pass@host:99/path/?query=value#fragment',
       (string)$uri,
       'uri');
 
 
     $uri = new PhutilURI('ssh://git@example.com/example/example.git');
     $this->assertEqual('ssh', $uri->getProtocol(), 'protocol');
     $this->assertEqual('git', $uri->getUser(), 'user');
     $this->assertEqual('', $uri->getPass(), 'pass');
     $this->assertEqual('example.com', $uri->getDomain(), 'domain');
     $this->assertEqual('', $uri->getPort(), 'port');
 
     $this->assertEqual('/example/example.git', $uri->getPath(), 'path');
     $this->assertEqual(array(), $uri->getQueryParams(), 'query params');
     $this->assertEqual('', $uri->getFragment(), 'fragment');
     $this->assertEqual(
       'ssh://git@example.com/example/example.git',
       (string)$uri,
       'uri');
   }
 
   public function testURIGeneration() {
     $uri = new PhutilURI('http://example.com');
     $uri->setPath('bar');
     $this->assertEqual('http://example.com/bar', $uri->__toString());
   }
 
+  public function testStrictURIParsingOfHosts() {
+    $uri = new PhutilURI('http://&amp;/');
+    $this->assertEqual('', $uri->getDomain());
+  }
 
 }