PHP validation/regex for URL

Question

I've been looking for a simple regex for URL's, does anybody have one handy that works well? I didn't find one with the zend framework validation classes and have seen several implementations.

Thanks

Owen · Accepted Answer · 2008-10-15 19:30:51Z

up vote 44 down vote accepted

i used this on a few projects, i don't believe i've run into issues, but i'm sure it's not exhaustive:

$text = preg_replace("
  #((http|https|ftp)://(\S*?\.\S*?))(\s|\;|\)|\]|\[|\{|\}|,|\"|'|:|\<|$|\.\s)#ie",
  "'<a href=\"$1\" target=\"_blank\">$3</a>$4'",
  $text
);

most of the random junk at the end is to deal with situations like http://domain.com. in a sentance (to avoid matching the trailing period). i'm sure it could be cleaned up but since it worked I've more or less just copied it over from project to project.

answered Oct 15 '08 at 19:30

Owen
36.6k1479101

This has been downvoted... can anyone explain why? – alex May 27 '09 at 3:30

4

Some things that jump out at me: use of alternation where character classes are called for (every alternative matches exactly one character); and the replacement shouldn't have needed the outer double-quotes (they were only needed because of the pointless /e modifier on the regex). – Alan Moore May 30 '09 at 5:53

Solution does not for the simple case of 'google.com' although it could be argued that 'google.com' is not a valid URL. – John Scipione Nov 11 '09 at 22:27

@John Scipione: google.com is only a valid relative URL path but not a valid absolute URL. And I think that’s what he’s looking for. – Gumbo Jan 4 '10 at 8:30

This doesn't work in this case - it includes the trailing ": 3 cantari noi in albumul <a href="audio.resursecrestine.ro/cantece/index-autori/andrei-rosu/…; – Softy Feb 2 '11 at 9:06

| show 4 more comments

Dave Jarvis · Answer 2 · 2013-04-14 05:29:33Z

up vote 180 down vote

Use the filter_var() function to validate whether a string is URL or not:

var_dump(filter_var('example.com', FILTER_VALIDATE_URL));

It is bad practice to use regular expressions when not necessary.

edited Apr 14 '13 at 5:29

Dave Jarvis
12.8k1574160

answered Oct 16 '08 at 6:55

Stanislav
2,014288

1

this is definitely a great alternative, unfortunately it's php 5.2+ (unless you install the PECL version) – Owen Oct 19 '08 at 8:07

25

There's a bug in 5.2.13 (and I think 5.3.2) that prevents urls with dashes in them from validating using this method. – vamin Jun 1 '10 at 23:27

10

filter_var will reject test-site.com, I have domain names with dashes, wheter they are valid or not. I don't think filter_var is the best way to validate a url. It will allow a url like http://www – Cesar Sep 6 '10 at 19:30

4

> It will allow a url like 'www'; It is OK when URL like 'localhost'; – Stanislav Sep 7 '10 at 10:34

10

The other problem with this method is it is not unicode-safe. – Benji XVI May 10 '11 at 13:24

| show 9 more comments

catchdave · Answer 3 · 2008-12-27 14:12:29Z

up vote 18 down vote

As per the PHP manual - parse_url should not be used to validate a URL.

Unfortunately, it seems that filter_var('example.com', FILTER_VALIDATE_URL) does not perform any better.

Both parse_url() and filter_var() will pass malformed URLs such as http://...

Therefore in this case - regex is the better method.

answered Dec 27 '08 at 14:12

catchdave
2,3891413

9

This argument doesn't follow. If FILTER_VALIDATE_URL is a little more permissive than you want, tack on some additional checks to deal with those edge cases. Reinventing the wheel with your own attempt at a regex against urls is only going to get you further from a complete check. – Kzqai Jul 19 '10 at 0:50

1

See all the shot-down regexes on this page for examples of why -not- to write your own. – Kzqai Jul 19 '10 at 2:54

3

You make a fair point Tchalvak. Regexes for something like URLs can (as per other responses) be very hard to get right. Regex is not always the answer. Conversely regex is also not always the wrong answer either. The important point is to pick the right tool (regex or otherwise) for the job and not be specifically "anti" or "pro" regex. In hindsight, your answer of using filter_var in combination with constraints on its edge-cases, looks like the better answer (particularly when regex answers start to get to greater than 100 chars or so - making maintenance of said regex a nightmare) – catchdave Jul 20 '10 at 4:54

add a comment |

Roger · Answer 4 · 2011-02-11 14:46:50Z

up vote 10 down vote

Just in case you want to know if the url really exists:

function url_exist($url){//se passar a URL existe
    $c=curl_init();
    curl_setopt($c,CURLOPT_URL,$url);
    curl_setopt($c,CURLOPT_HEADER,1);//get the header
    curl_setopt($c,CURLOPT_NOBODY,1);//and *only* get the header
    curl_setopt($c,CURLOPT_RETURNTRANSFER,1);//get the response as a string from curl_exec(), rather than echoing it
    curl_setopt($c,CURLOPT_FRESH_CONNECT,1);//don't use a cached version of the url
    if(!curl_exec($c)){
        //echo $url.' inexists';
        return false;
    }else{
        //echo $url.' exists';
        return true;
    }
    //$httpcode=curl_getinfo($c,CURLINFO_HTTP_CODE);
    //return ($httpcode<400);
}

edited Feb 11 '11 at 14:46

answered Feb 11 '11 at 13:04

Roger
2,07822648

I would still do some kind of validation on $url before actually verifying the url is real because the above operation is expensive - perhaps as much as 200 milliseconds depending on file size. In some cases the url may not actually have a resource at its location available yet (e.g. creating a url to an image that has yet to be uploaded). Additionally you're not using a cached version so its not like file_exists() that will cache a stat on a file and return nearly instantly. The solution you provided is still useful though. Why not just use fopen($url, 'r')? – Yzmir Ramirez Aug 6 '11 at 18:14

Thanks, just what I was looking for. However, I made a mistake trying to use it. The function is "url_exist" not "url_exists" oops ;-) – PJ Brunet Mar 20 '12 at 20:24

5

Is there any security risk in directly accessing the user entered URL? – siliconpi May 10 '12 at 7:14

add a comment |

kapa · Answer 5 · 2011-05-12 09:14:34Z

I don't think that using regular expressions is a smart thing to do in this case. It is impossible to match all of the possibilities and even if you did, there is still a chance that url simply doesn't exist.

Here is a very simple way to test if url actually exists and is readable :

if (preg_match("#^https?://.+#", $link) and @fopen($link,"r")) echo "OK";

(if there is no preg_match then this would also validate all filenames on your server)

Vikash Kumar · Answer 6 · 2012-10-16 08:57:46Z

    function validateURL($URL) {
      $pattern_1 = "/^(http|https|ftp):\/\/(([A-Z0-9][A-Z0-9_-]*)(\.[A-Z0-9][A-Z0-9_-]*)+.(com|org|net|dk|at|us|tv|info|uk|co.uk|biz|se)$)(:(\d+))?\/?/i";
      $pattern_2 = "/^(www)((\.[A-Z0-9][A-Z0-9_-]*)+.(com|org|net|dk|at|us|tv|info|uk|co.uk|biz|se)$)(:(\d+))?\/?/i";       
      if(preg_match($pattern_1, $URL) || preg_match($pattern_2, $URL)){
        return true;
      } else{
        return false;
      }
    }

abhiomkar · Answer 7 · 2011-03-13 11:46:46Z

As per John Gruber (Daring Fireball):

Regex:

(?i)\b((?:https?://|www\d{0,3}[.]|[a-z0-9.\-]+[.][a-z]{2,4}/)(?:[^\s()<>]+|\(([^\s()<>]+|(\([^\s()<>]+\)))*\))+(?:\(([^\s()<>]+|(\([^\s()<>]+\)))*\)|[^\s`!()\[\]{};:'\".,<>?«»“”‘’]))

using in preg_match():

preg_match("/(?i)\b((?:https?://|www\d{0,3}[.]|[a-z0-9.\-]+[.][a-z]{2,4}/)(?:[^\s()<>]+|\(([^\s()<>]+|(\([^\s()<>]+\)))*\))+(?:\(([^\s()<>]+|(\([^\s()<>]+\)))*\)|[^\s`!()\[\]{};:'\".,<>?«»“”‘’]))/", $url)

Here is the extended regex pattern (with comments):

(?xi)
\b
(                       # Capture 1: entire matched URL
  (?:
    https?://               # http or https protocol
    |                       #   or
    www\d{0,3}[.]           # "www.", "www1.", "www2." … "www999."
    |                           #   or
    [a-z0-9.\-]+[.][a-z]{2,4}/  # looks like domain name followed by a slash
  )
  (?:                       # One or more:
    [^\s()<>]+                  # Run of non-space, non-()<>
    |                           #   or
    \(([^\s()<>]+|(\([^\s()<>]+\)))*\)  # balanced parens, up to 2 levels
  )+
  (?:                       # End with:
    \(([^\s()<>]+|(\([^\s()<>]+\)))*\)  # balanced parens, up to 2 levels
    |                               #   or
    [^\s`!()\[\]{};:'".,<>?«»“”‘’]        # not a space or one of these punct chars
  )
)

For more details please look at: http://daringfireball.net/2010/07/improved_regex_for_matching_urls

Peter Bailey · Answer 8 · 2008-10-15 19:36:07Z

up vote 3 down vote

I've used this one with good success - I don't remember where I got it from

$pattern = "/\b(?:(?:https?|ftp):\/\/|www\.)[-a-z0-9+&@#\/%?=~_|!:,.;]*[-a-z0-9+&@#\/%=~_|]/i";

answered Oct 15 '08 at 19:36

Peter Bailey
63.2k18107153

^(http://|https://)?(([a-z0-9]?([-a-z0-9]*[a-z0-9]+)?){1,63}\.)+[a-z]{2,6} (may be too greedy, not sure yet, but it's more flexible on protocol and leading www) – andrewbadera Aug 26 '09 at 15:54

The @Peter Bailey's regex passes example.123 – Roger Feb 11 '11 at 12:40

add a comment |

Frankie · Answer 9 · 2009-12-10 18:08:30Z

up vote 3 down vote

Edit:
As incidence pointed out this code has been DEPRECATED with the release of PHP 5.3.0 (2009-06-30) and should be used accordingly.

Just my two cents but I've developed this function and have been using it for a while with success. It's well documented and separated so you can easily change it.

// Checks if string is a URL
// @param string $url
// @return bool
function isURL($url = NULL) {
	if($url==NULL) return false;

	$protocol = '(http://|https://)';
	$allowed = '([a-z0-9]([-a-z0-9]*[a-z0-9]+)?)';

	$regex = "^". $protocol . // must include the protocol
			 '(' . $allowed . '{1,63}\.)+'. // 1 or several sub domains with a max of 63 chars
			 '[a-z]' . '{2,6}'; // followed by a TLD
	if(eregi($regex, $url)==true) return true;
	else return false;
}

edited Dec 10 '09 at 18:08

answered Mar 12 '09 at 17:17

Frankie
12.7k53978

1

Eregi will be removed in PHP 6.0.0. And domains with "öäåø" will not validate with your function. You probably should convert the URL to punycode first? – incidence Dec 10 '09 at 15:48

@incidence absolutely agree. I wrote this in March and PHP 5.3 only came out late June setting eregi as DEPRECATED. Thank you. Gonna edit and update. – Frankie Dec 10 '09 at 18:05

Correct me if I'm wrong, but can we still assume TLDs will have a minimum of 2 characters and maximum of 6 characters? – Yzmir Ramirez Aug 6 '11 at 18:15

add a comment |

jini · Answer 10 · 2011-03-30 20:45:07Z

function is_valid_url ($url="") {

        if ($url=="") {
            $url=$this->url;
        }

        $url = @parse_url($url);

        if ( ! $url) {


            return false;
        }

        $url = array_map('trim', $url);
        $url['port'] = (!isset($url['port'])) ? 80 : (int)$url['port'];
        $path = (isset($url['path'])) ? $url['path'] : '';

        if ($path == '') {
            $path = '/';
        }

        $path .= ( isset ( $url['query'] ) ) ? "?$url[query]" : '';



        if ( isset ( $url['host'] ) AND $url['host'] != gethostbyname ( $url['host'] ) ) {
            if ( PHP_VERSION >= 5 ) {
                $headers = get_headers("$url[scheme]://$url[host]:$url[port]$path");
            }
            else {
                $fp = fsockopen($url['host'], $url['port'], $errno, $errstr, 30);

                if ( ! $fp ) {
                    return false;
                }
                fputs($fp, "HEAD $path HTTP/1.1\r\nHost: $url[host]\r\n\r\n");
                $headers = fread ( $fp, 128 );
                fclose ( $fp );
            }
            $headers = ( is_array ( $headers ) ) ? implode ( "\n", $headers ) : $headers;
            return ( bool ) preg_match ( '#^HTTP/.*\s+[(200|301|302)]+\s#i', $headers );
        }

        return false;
    }

pretty nice on security XD – Gunslinger_ Jul 18 '11 at 7:42 — Gunslinger_, Jul 18 '11 at 7:42

Joe Frambach · Answer 11 · 2013-07-15 13:20:16Z

And there is your answer =) Try to break it, you can't!!!

function link_validate_url($text) {
$LINK_DOMAINS = 'aero|arpa|asia|biz|com|cat|coop|edu|gov|info|int|jobs|mil|museum|name|nato|net|org|pro|travel|mobi|local';
  $LINK_ICHARS_DOMAIN = (string) html_entity_decode(implode("", array( // @TODO completing letters ...
    "&#x00E6;", // æ
    "&#x00C6;", // Æ
    "&#x00C0;", // À
    "&#x00E0;", // à
    "&#x00C1;", // Á
    "&#x00E1;", // á
    "&#x00C2;", // Â
    "&#x00E2;", // â
    "&#x00E5;", // å
    "&#x00C5;", // Å
    "&#x00E4;", // ä
    "&#x00C4;", // Ä
    "&#x00C7;", // Ç
    "&#x00E7;", // ç
    "&#x00D0;", // Ð
    "&#x00F0;", // ð
    "&#x00C8;", // È
    "&#x00E8;", // è
    "&#x00C9;", // É
    "&#x00E9;", // é
    "&#x00CA;", // Ê
    "&#x00EA;", // ê
    "&#x00CB;", // Ë
    "&#x00EB;", // ë
    "&#x00CE;", // Î
    "&#x00EE;", // î
    "&#x00CF;", // Ï
    "&#x00EF;", // ï
    "&#x00F8;", // ø
    "&#x00D8;", // Ø
    "&#x00F6;", // ö
    "&#x00D6;", // Ö
    "&#x00D4;", // Ô
    "&#x00F4;", // ô
    "&#x00D5;", // Õ
    "&#x00F5;", // õ
    "&#x0152;", // Œ
    "&#x0153;", // œ
    "&#x00FC;", // ü
    "&#x00DC;", // Ü
    "&#x00D9;", // Ù
    "&#x00F9;", // ù
    "&#x00DB;", // Û
    "&#x00FB;", // û
    "&#x0178;", // Ÿ
    "&#x00FF;", // ÿ 
    "&#x00D1;", // Ñ
    "&#x00F1;", // ñ
    "&#x00FE;", // þ
    "&#x00DE;", // Þ
    "&#x00FD;", // ý
    "&#x00DD;", // Ý
    "&#x00BF;", // ¿
  )), ENT_QUOTES, 'UTF-8');

  $LINK_ICHARS = $LINK_ICHARS_DOMAIN . (string) html_entity_decode(implode("", array(
    "&#x00DF;", // ß
  )), ENT_QUOTES, 'UTF-8');
  $allowed_protocols = array('http', 'https', 'ftp', 'news', 'nntp', 'telnet', 'mailto', 'irc', 'ssh', 'sftp', 'webcal');

  // Starting a parenthesis group with (?: means that it is grouped, but is not captured
  $protocol = '((?:'. implode("|", $allowed_protocols) .'):\/\/)';
  $authentication = "(?:(?:(?:[\w\.\-\+!$&'\(\)*\+,;=" . $LINK_ICHARS . "]|%[0-9a-f]{2})+(?::(?:[\w". $LINK_ICHARS ."\.\-\+%!$&'\(\)*\+,;=]|%[0-9a-f]{2})*)?)?@)";
  $domain = '(?:(?:[a-z0-9' . $LINK_ICHARS_DOMAIN . ']([a-z0-9'. $LINK_ICHARS_DOMAIN . '\-_\[\]])*)(\.(([a-z0-9' . $LINK_ICHARS_DOMAIN . '\-_\[\]])+\.)*('. $LINK_DOMAINS .'|[a-z]{2}))?)';
  $ipv4 = '(?:[0-9]{1,3}(\.[0-9]{1,3}){3})';
  $ipv6 = '(?:[0-9a-fA-F]{1,4}(\:[0-9a-fA-F]{1,4}){7})';
  $port = '(?::([0-9]{1,5}))';

  // Pattern specific to external links.
  $external_pattern = '/^'. $protocol .'?'. $authentication .'?('. $domain .'|'. $ipv4 .'|'. $ipv6 .' |localhost)'. $port .'?';

  // Pattern specific to internal links.
  $internal_pattern = "/^(?:[a-z0-9". $LINK_ICHARS ."_\-+\[\]]+)";
  $internal_pattern_file = "/^(?:[a-z0-9". $LINK_ICHARS ."_\-+\[\]\.]+)$/i";

  $directories = "(?:\/[a-z0-9". $LINK_ICHARS ."_\-\.~+%=&,$'#!():;*@\[\]]*)*";
  // Yes, four backslashes == a single backslash.
  $query = "(?:\/?\?([?a-z0-9". $LINK_ICHARS ."+_|\-\.~\/\\\\%=&,$'():;*@\[\]{} ]*))";
  $anchor = "(?:#[a-z0-9". $LINK_ICHARS ."_\-\.~+%=&,$'():;*@\[\]\/\?]*)";

  // The rest of the path for a standard URL.
  $end = $directories .'?'. $query .'?'. $anchor .'?'.'$/i';

  $message_id = '[^@].*@'. $domain;
  $newsgroup_name = '(?:[0-9a-z+-]*\.)*[0-9a-z+-]*';
  $news_pattern = '/^news:('. $newsgroup_name .'|'. $message_id .')$/i';

  $user = '[a-zA-Z0-9'. $LINK_ICHARS .'_\-\.\+\^!#\$%&*+\/\=\?\`\|\{\}~\'\[\]]+';
  $email_pattern = '/^mailto:'. $user .'@'.'(?:'. $domain .'|'. $ipv4 .'|'. $ipv6 .'|localhost)'. $query .'?$/';

  if (strpos($text, '<front>') === 0) {
    return false;
  }
  if (in_array('mailto', $allowed_protocols) && preg_match($email_pattern, $text)) {
    return false;
  }
  if (in_array('news', $allowed_protocols) && preg_match($news_pattern, $text)) {
    return false;
  }
  if (preg_match($internal_pattern . $end, $text)) {
    return false;
  }
  if (preg_match($external_pattern . $end, $text)) {
    return false;
  }
  if (preg_match($internal_pattern_file, $text)) {
    return false;
  }

  return true;
}

favoretti · Answer 12 · 2012-08-05 23:29:32Z

up vote 1 down vote

I used this one for quite some time with good rate of success:

(?:(?:ht|f)tps?://)*(?:[a-zA-Z0-9-]+\\.)+(?:com|net|org|info|mil|gov|edu|name|xxx|[a-z]{2}){1}(?::[0-9]+)?(?![a-z])(?:/[a-zA-Z0-9\\^\\.\\{\\}\\(\\)\\[\\]_\\?,'/\\\\+&%\\$:#=~-]*)*

Since it's been in use for a few years it might need to be updated for some newer TLDs though.

answered Aug 5 '12 at 23:29

favoretti
10.3k3926

Well, to make your answer worth adding it to 15 existing (and accepted) answers you could at least suggest an update for some newer TLD's. – Gert Arnold Aug 6 '12 at 0:24

Pardon me, not following you here. Isn't that what I did? :) – favoretti Aug 6 '12 at 0:25

I mean: offer a suggested update, not just tell that it might be necessary. – Gert Arnold Aug 7 '12 at 13:50

add a comment |

joedevon · Answer 13 · 2009-05-30 05:11:48Z

Peter's Regex doesn't look right to me for many reasons. It allows all kinds of special characters in the domain name and doesn't test for much.

Frankie's function looks good to me and you can build a good regex from the components if you don't want a function, like so:

^(http://|https://)(([a-z0-9]([-a-z0-9]*[a-z0-9]+)?){1,63}\.)+[a-z]{2,6}

Untested but I think that should work.

Also, Owen's answer doesn't look 100% either. I took the domain part of the regex and tested it on a Regex tester tool http://erik.eae.net/playground/regexp/regexp.html

I put the following line:

(\S*?\.\S*?)

in the "regexp" section and the following line:

-hello.com

under the "sample text" section.

The result allowed the minus character through. Because \S means any non-space character.

Note the regex from Frankie handles the minus because it has this part for the first character:

[a-z0-9]

Which won't allow the minus or any other special character.

timgws · Answer 14 · 2014-02-19 05:47:47Z

OK, so this is a little bit more complex then a simple regex, but it allows for different types of urls.

Examples:

google.com
www.microsoft.com/
http://www.yahoo.com/
https://www.bandcamp.com/artist/#!someone-special!

All which should be marked as valid.

function is_valid_url($url) {
    // First check: is the url just a domain name? (allow a slash at the end)
    $_domain_regex = "|^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(\.[A-Za-z]{2,})/?$|";
    if (preg_match($_domain_regex, $url)) {
        return true;
    }

    // Second: Check if it's a url with a scheme and all
    $_regex = '#^([a-z][\w-]+:(?:/{1,3}|[a-z0-9%])|www\d{0,3}[.]|[a-z0-9.\-]+[.][a-z]{2,4}/)(?:[^\s()<>]+|\(([^\s()<>]+|(\([^\s()<>]+\)))*\))$#';
    if (preg_match($_regex, $url, $matches)) {
        // pull out the domain name, and make sure that the domain is valid.
        $_parts = parse_url($url);
        if (!in_array($_parts['scheme'], array( 'http', 'https' )))
            return false;

        // Check the domain using the regex, stops domains like "-example.com" passing through
        if (!preg_match($_domain_regex, $_parts['host']))
            return false;

        // This domain looks pretty valid. Only way to check it now is to download it!
        return true;
    }

    return false;
}

Note that there is a in_array check for the protocols that you want to allow (it will even accept valid mailto: schemes, sometimes!)

Thomas Venturini · Answer 15 · 2014-08-21 09:17:01Z

Here is the way I did it. But I want to mentoin that I am not so shure about the regex. But It should work thou :)

$pattern = "#((http|https)://(\S*?\.\S*?))(\s|\;|\)|\]|\[|\{|\}|,|”|\"|'|:|\<|$|\.\s)#i";
        $text = preg_replace_callback($pattern,function($m){
                return "<a href=\"$m[1]\" target=\"_blank\">$m[1]</a>$m[4]";
            },
            $text);

This way you won't need the eval marker on your pattern.

Hope it helps :)

Jeremy Moore · Answer 16 · 2012-08-05 23:17:48Z

up vote -1 down vote

I've found this to be the most useful for matching a URL..

^(https?:\/\/)?([\da-z\.-]+)\.([a-z\.]{2,6})([\/\w \.-]*)*\/?$

answered Aug 5 '12 at 23:17

Jeremy Moore
91

1

Will that match URLs that begin with ftp: ? – andrewsi Sep 30 '12 at 20:27

/^(https?:\/\/)?([\da-z\.-]+)\.([a-z\.]{2,6})([\/\w \.-]*)*\/?$/ – Shahbaz Sep 26 '13 at 11:43

add a comment |

asked	5 years ago
viewed	96530 times
active	19 days ago

current community

your communities

more stack exchange communities

PHP validation/regex for URL

16 Answers 16

protected by Mr. Alien May 30 '13 at 9:18

Not the answer you're looking for? Browse other questions tagged php regex url validation or ask your own question.

Linked

Hot Network Questions

current community

your communities

more stack exchange communities

PHP validation/regex for URL

16 Answers 16

protected by Mr. Alien May 30 '13 at 9:18

Not the answer you're looking for? Browse other questions tagged php regex url validation or ask your own question.

Linked

Related

Hot Network Questions