WordPress provides a helpful function called is_email()
which checks if a given email address is valid. Is there a similar function available to check if a URL is valid?
I tried is_url()
but that was just wishful thinking on my part.
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It only takes a minute to sign up.
Sign up to join this communityWordPress provides a helpful function called is_email()
which checks if a given email address is valid. Is there a similar function available to check if a URL is valid?
I tried is_url()
but that was just wishful thinking on my part.
Use the native php function Filter Validator
if (filter_var($url, FILTER_VALIDATE_URL) === FALSE) {
die('Not a valid URL');
}
$pdo->query("SELECT pw FROM users WHERE id={$_GET['id']}")
.
– dotancohen
Jul 8 '18 at 14:35
FILTER_VALIDATE_URL
does not.
– thespacecamel
Sep 3 '18 at 17:51
ttps://www.youtube.com
as valid. In other word - do not use FILTER_VALIDATE_URL - it is unreliable.
– Jeffz
May 17 '20 at 13:40
I know this is an old post, but for anyone visiting it's also worth considering the WP functions esc_url()
and esc_url_raw()
, the latter being safe for databases entries etc, as it does not encode entities. esc_url()
does encode entities and so is good for display to users.
In the source you can see that esc_url()
checks for a whitelist of allowed protocols and structure and so avoids some of the vulnerabilities of FILTER_VALIDATE_URL
noted by the link posed by @tobltobs.
I found wp_http_validate_url
quite convenient to check if a string in valid URL or not while working on my project.
Take a reference from here: https://developer.wordpress.org/reference/functions/wp_http_validate_url/
For example:
$val = 'http://somevalidurl.com';
if ( wp_http_validate_url( $val ) ) {
// It's valid URL;
} else {
// It's NOT valid URL;
}
It returns the URL itself if it's valid,else false.
localhost
to be invalid; but it found http://example.com/"><script>alert("xss")</script>
to be valid.
– thespacecamel
Sep 3 '18 at 17:57
http://localhost
invalid.
– thespacecamel
Sep 3 '18 at 18:05
http_request_host_is_external
filter to allow localhost: function allow_some_url( $external, $host, $url ) { return ( $host === 'localhost' ) ? true : $external; } add_filter( 'http_request_host_is_external', 'allow_some_url', 10, 3 ); if ( wp_http_validate_url( 'http://localhost/wordpress/' ) ) { echo 'valid'; } else { echo 'invalid'; }
– Ashish Shrestha
Sep 4 '18 at 11:33
gethostbyname()
to get the IP of the URL to make further assertions.
– Lucas Bustamante
Jan 19 '20 at 21:50
To ensure user-submitted URL is valid and safe to store and later display, I suggest
esc_url_raw($url) === $url
esc_url_raw()
, like @orionrush mentioned above, sanitizes the URL by removing anything invalid or malicious from it. So, if there string has nothing invalid or malicious, then it's ok.
Eg
if( esc_url_raw($url) === $url ) {
// URL is valid. Use it...
} else {
// URL is invalid or malicious. Don't use it...
}
I wrote a longer blog post on that here: https://cmljnelson.wordpress.com/2018/08/31/url-validation-in-wordpress/
In my opinion is better to use wp_http_validate_url.
Example 1:
filter_var( '//website.com', FILTER_VALIDATE_URL )
Return false.
Example 2:
wp_http_validate_url( '//website.com' )
Return url.
Ref: https://developer.wordpress.org/reference/functions/wp_http_validate_url/
is_email()
, actually do not check if an email address is valid, only if it is conforming to spec. The email I gladly supply for many sites that show pointless interest in my email address is a@b.com which is conforming address but it is unlikely to have anyone using it.
Checking out urls is best done by pinging them. You can try to check conformance, but in theory there are very little limitation to what an encoded url can be.