diff --git a/core/includes/common.inc b/core/includes/common.inc
index cf4bbb6..a84205f 100644
--- a/core/includes/common.inc
+++ b/core/includes/common.inc
@@ -276,14 +276,15 @@ function valid_email_address($mail) {
  *   value within a $attributes array passed to Drupal\Core\Template\Attribute,
  *   because Drupal\Core\Template\Attribute expects those values to be
  *   plain-text strings. To pass a filtered URI to
- *   Drupal\Core\Template\Attribute, call
- *   \Drupal\Component\Utility\UrlHelper::stripDangerousProtocols() instead.
+ *   Drupal\Core\Template\Attribute, call UrlHelper::stripDangerousProtocols()
+ *   instead. The output is not marked safe either limiting the usefulness of
+ *   this method. It is better to use UrlHelper::stripDangerousProtocols() and
+ *   let Twig or SafeMarkup::format() to auto-escape the URI.
  *
  * @see \Drupal\Component\Utility\UrlHelper::stripDangerousProtocols()
- * @see \Drupal\Component\Utility\SafeMarkup::checkPlain()
  */
 function check_url($uri) {
-  return SafeMarkup::checkPlain(UrlHelper::stripDangerousProtocols($uri));
+  return htmlspecialchars(UrlHelper::stripDangerousProtocols($uri), ENT_QUOTES, 'UTF-8');
 }
 
 /**
diff --git a/core/includes/install.core.inc b/core/includes/install.core.inc
index fb18fe3..132483e 100644
--- a/core/includes/install.core.inc
+++ b/core/includes/install.core.inc
@@ -2033,7 +2033,7 @@ function install_check_translations($langcode, $server_pattern) {
         'title'       => t('Translation'),
         'value'       => t('The %language translation is not available.', array('%language' => $language)),
         'severity'    => REQUIREMENT_ERROR,
-        'description' => t('The %language translation file is not available at the translation server. <a href="!url">Choose a different language</a> or select English and translate your website later.', array('%language' => $language, '!url' => check_url($_SERVER['SCRIPT_NAME']))),
+        'description' => t('The %language translation file is not available at the translation server. <a href="@url">Choose a different language</a> or select English and translate your website later.', array('%language' => $language, '@url' => UrlHelper::stripDangerousProtocols($_SERVER['SCRIPT_NAME']))),
       );
     }
     else {
@@ -2052,7 +2052,7 @@ function install_check_translations($langcode, $server_pattern) {
         'title'       => t('Translation'),
         'value'       => t('The %language translation could not be downloaded.', array('%language' => $language)),
         'severity'    => REQUIREMENT_ERROR,
-        'description' => t('The %language translation file could not be downloaded. <a href="!url">Choose a different language</a> or select English and translate your website later.', array('%language' => $language, '!url' => check_url($_SERVER['SCRIPT_NAME']))),
+        'description' => t('The %language translation file could not be downloaded. <a href="@url">Choose a different language</a> or select English and translate your website later.', array('%language' => $language, '!url' => UrlHelper::stripDangerousProtocols($_SERVER['SCRIPT_NAME']))),
       );
     }
   }
@@ -2269,11 +2269,11 @@ function install_display_requirements($install_state, $requirements) {
       $build['report']['#requirements'] = $requirements;
       if ($severity == REQUIREMENT_WARNING) {
         $build['#title'] = t('Requirements review');
-        $build['#suffix'] = t('Check the messages and <a href="!retry">retry</a>, or you may choose to <a href="!cont">continue anyway</a>.', array('!retry' => check_url(drupal_requirements_url(REQUIREMENT_ERROR)), '!cont' => check_url(drupal_requirements_url($severity))));
+        $build['#suffix'] = t('Check the messages and <a href="@retry">retry</a>, or you may choose to <a href="@cont">continue anyway</a>.', array('@retry' => UrlHelper::stripDangerousProtocols(drupal_requirements_url(REQUIREMENT_ERROR)), '@cont' => UrlHelper::stripDangerousProtocols(drupal_requirements_url($severity))));
       }
       else {
         $build['#title'] = t('Requirements problem');
-        $build['#suffix'] = t('Check the messages and <a href="!url">try again</a>.', array('!url' => check_url(drupal_requirements_url($severity))));
+        $build['#suffix'] = t('Check the messages and <a href="@url">try again</a>.', array('@url' => UrlHelper::stripDangerousProtocols(drupal_requirements_url($severity))));
       }
       return $build;
     }
diff --git a/core/modules/search/search.pages.inc b/core/modules/search/search.pages.inc
index b50a6cd..da25b7a 100644
--- a/core/modules/search/search.pages.inc
+++ b/core/modules/search/search.pages.inc
@@ -6,6 +6,7 @@
  */
 
 use Drupal\Component\Utility\SafeMarkup;
+use Drupal\Component\Utility\UrlHelper;
 use Drupal\Core\Language\LanguageInterface;
 
 /**
@@ -35,7 +36,7 @@ function template_preprocess_search_result(&$variables) {
   $language_interface = \Drupal::languageManager()->getCurrentLanguage();
 
   $result = $variables['result'];
-  $variables['url'] = check_url($result['link']);
+  $variables['url'] = UrlHelper::stripDangerousProtocols($result['link']);
   $variables['title'] = SafeMarkup::checkPlain($result['title']);
   if (isset($result['language']) && $result['language'] != $language_interface->getId() && $result['language'] != LanguageInterface::LANGCODE_NOT_SPECIFIED) {
     $variables['title_attributes']['lang'] = $result['language'];