Why is this preg_match letting almost anything through?

Question

I'm trying to use preg_match to test an URL.

here's a part of my code:

$url_array[0] = $_REQUEST['url0'];
$url_array[1] = $_REQUEST['url1'];
$url_array[2] = $_REQUEST['url2'];
$url_array[3] = $_REQUEST['url3'];
$url_array[4] = $_REQUEST['url4'];

foreach ($url_array as &$val) {
    if(substr($val, 0, 7) != "http://" && substr($val, 0, 8) != "https://" && substr($val, 0, 4) != "www." && $val != "") {
        $val = "http://".$val;
    }
}

foreach ($url_array as &$val) {
    if(!preg_match("/\b(?:(?:https?|ftp):\/\/|www\.)[-a-z0-9+&@#\/%?=~_|!:,.;]*[-a-z0-9+&@#\/%=~_|]/i", $val) && $val != "") {
    header("Location: {$_SERVER["PHP_SELF"]}?p=home&x=urlerror");
    exit;
    }
}

The problem is it lets through random stuff like http://i'll just use whatever ;G characters here and it'll be fine as an URL. Why is this?

Thanks!
-G

FINAL CONCLUSION:

Regex for URL sorta sucks, I exchanged it for this:

foreach ($url_array as &$val) {
    if(!filter_var($val, FILTER_VALIDATE_URL) === true && $val != "") {
        header("Location: {$_SERVER["PHP_SELF"]}?p=home&x=urlerror");
        exit;
    }
}

And it seems to work perfectly. :)

Thanks to @Passerby and @Chris85

@chris85 Well, I don't want it to allow like spaces and characters that wouldn't be in an URL. — Haxo201, Nov 02 '15 at 03:35
Or [`filter_var`](https://secure.php.net/manual/en/function.filter-var.php) with [`FILTER_VALIDATE_URL` filter](https://secure.php.net/manual/en/filter.filters.validate.php). — Passerby, Nov 02 '15 at 03:37
@chris85 No, not really... How easy is it to implement and how much better is it? — Haxo201, Nov 02 '15 at 03:38
@Passerby What would you recommend; Regex, filter_var or Parse_url? — Haxo201, Nov 02 '15 at 03:40
Filer_var is the one i meant. Go with that or see this thread. http://stackoverflow.com/questions/206059/php-validation-regex-for-url — chris85, Nov 02 '15 at 03:41
@Haxo201 `filter_var` is the way PHP is meant to validate url. — Passerby, Nov 02 '15 at 03:46
@Passerby I exchanged it to filter_var with FILTER_VALIDATE_URL and it seems to work perfectly! Thank you so much! :) — Haxo201, Nov 02 '15 at 04:07

Why is this preg_match letting almost anything through?

0 Answers0