Use Chrome Browser! & You should alert(document.domain), not alert(1)

Question 1. Find Open Redirect Vulnerability with 'url' parameter.
Question 2. Find Reflected XSS with Open Redirect Vulnerability with 'url' parameter.
filtering list is -> [ ' " ' , ' \' ' , ' % ' , ' + ' , ' # ' ,' < ' , ' > ' , ' & ' , ' ( ' , ' ) ' ]
-----------------------------------------------
[source code]


$url = $_GET['url'];
$filter_list = ['"','\'','%','+','#','<','>','&','(',')'];
if(strpos($url,"ar9ang3.com/test.html")===false) {
exit("alert('open redirect detected!-1');");
}
$strtok = explode('ar9ang3.com/', $url);
if(strpos($strtok[0],".com/")!==false or strpos($strtok[0],"?http")!==false) {
exit("alert('open redirect detected!-2');");
}
for($i=0; $i if(strpos($url, $filter_list[$i])!==false) {
exit("alert('xss detected!');");
}
}
echo " location.replace('$url'); ";