Beyond filter_var, also require the URL to have an http(s) scheme and a non-empty host. Rejects "javascript:" and other risky pseudo-schemes commonly seen in stored XSS.
PHP
<?php
function isValidHttpUrl(string $url): bool {
if (!filter_var($url, FILTER_VALIDATE_URL)) return false;
$parts = parse_url($url);
if (!$parts || empty($parts['host'])) return false;
return in_array(strtolower($parts['scheme'] ?? ''), ['http', 'https'], true);
}
var_dump(isValidHttpUrl('https://example.com')); // true
var_dump(isValidHttpUrl('javascript:alert(1)')); // false
var_dump(isValidHttpUrl('ftp://files.example.com')); // falseSave your own code snippets
Create a free account and build your private vault. Share publicly whenever you want.