Validate URL with ER

Question

I have a validation class and need a method to validate URL’s, but the function filter_var contains flaws to validate them.

---

_{An example of 3 Urls:}

_{The URL is complete returns TRUE
#1 'http://www.youtube.com' | string(22) "..."}

_{Invalid URL and still function returns TRUE
#2 'tp://www.youtube.com' | string(20) "..."}

_{The URL returns FALSE
#3 'youtube.com' | bool(false)}

---

I do not know if the fault is with the protocol HTTP|HTTPS, I haven’t run out of tests yet.
The rules for validating URL’s from what I’ve seen are huge and I don’t quite understand all the rules.

I thought I’d use preg_match before filter_var to find the protocol with the ER:
"/(http|https):\/\/(.*?)$/i".

My fear is that it will also fail.
Someone has a simple suggestion for this impasse - other than a complex ER?

Answer 1

For the record, there is no To regular expression to validate Urls and guilt is in part/are of Rfc(s). And so is for any data that relies on a.

The filtering functions of PHP even follow the proper specifications, but they do not cover all cases and, for others, in order not to avoid false-positives, it decreases the restriction according to your need, through the configuration flags, allowing you to have the flexibility needed for each case.

Only for future references, by default, if omitted the second argument, it only treats the data as a common string.

In your case, given the absence of the form of use, I imagine you’re doing this:

filter_var( 'http://www.youtube.com', FILTER_VALIDATE_URL );

The first URL validates because it contains the main elements of a URL which are the schema, the domain and the TLD.

In the second case it also validates because it also has the three basic Components, even if one of them is wrong.

So that the second URL also returned FALSE would need to match the first flag with FILTER_FLAG_SCHEME_REQUIRED.

The third URL is valid for the user, for the browser, but not for RFC because it lacks one of the basic components required by the specification.

What you could do is, like everything that comes from the user, before you even validate it, is sanitize the URL. A few things that occur to me:

• Check if there are no schemas broken, as in the second URL and fix them, either by removing or fixing when and if possible
• Add the schema pattern http:// at the beginning of the missing URL (or qebrado and now removed), after all, an FTP or HTTPS URL (or ED2K, Magnet, torrent...) that does not have such specific prefixes will not be treated as special anyway.

And always warn the user through a tip on GUI that the format is http://domain.com. If he type wrong, the system fails to fix the check fails, warned he went and will have to fill it up again.

Answer 2

Your second example is a URL valid! As Urls have the general format:

esquema://máquina/caminho/recurso

http and https are just two examples of schema (schema; sometimes called "protocol"). Others would be the ftp, the file... Nothing stops someone from creating a scheme tp, so the validator accepted his second example.

If you want to restrict the scheme to http and https, I suggest simply testing why soon after the filter_var:

strpos($url, "http:") === 0 || strpos($url, "https:") === 0

(Note: why I do not test only if the prefix is http? Because that would accept Urls as httpabc://...)

Answer 3

I use this regex and am satisfied with the results

(preg_match("%^(?:(?:https?|ftp)://)(?:\S+(?::\S*)?@|\d{1,3}(?:\.\d{1,3}){3}|(?:(?:[a-z\d\x{00a1}-\x{ffff}]+-?)*[a-z\d\x{00a1}-\x{ffff}]+)(?:\.(?:[a-z\d\x{00a1}-\x{ffff}]+-?)*[a-z\d\x{00a1}-\x{ffff}]+)*(?:\.[a-z\x{00a1}-\x{ffff}]{2,6}))(?::\d+)?(?:[^\s]*)?$%iu", $url)))

You can find regex at https://gist.github.com/dperini/729294