Url validator prone to XSS

\Phalcon\Validator\Validation\Url uses PHP internal function filter_var(), a function that, when validating url, is prone to XSS. Consider the following snippet:

    $url = 'https://phalcon.io/"><script>alert("I.AM.THE.COOKIE.MONSTER!\n\n\n"+document.cookie)</script>';

        $validation = new \Phalcon\Validation();
        $validation->add('url', new \Phalcon\Validation\Validator\Url());
        $messages = $validation->validate(array('url' => $url));

        if (0 === count($messages)) {
            echo '<a href="' . $url . '">Click here</a>';
        }