Why Php Filters Fail?

Question

Why Php Filters Malfunction ?

Q1. This is surely an invalid url: http://gvdvb.com/?mail=ali&bus=wertdomainn#wronghttp://gvdvb.com/?mail=ali&bus=wert(

The final character renders the above as an invalid url according to this url filter: https://regexr.com/39nr7

So how come php validates this invalid url ? I get no alert that the url I input in the url input field in the form is an invalid url.

Url Filter

<form method="POST" name="textfield" id="textfield" action="">
<fieldset>
<label for="url">Url:</label><br>
<input type="text" name="url" id="domain" maxlength="255" size="20">
<br>
<button type="submit">Submit Now!</button>
</form>

<?php


if($_SERVER['REQUEST_METHOD'] === 'POST')
{
    if(ISSET($_POST['url']))
    {
        if(!filter_input(INPUT_POST,'url',FILTER_VALIDATE_URL))
        {
            die('Invalid Url: ' .$_POST['url']); echo '<br>';
        }
        else
        {
            $url = $_POST['url'];
            $parse = parse_url($url);
            $domain = $parse['host'];
            
            if(!filter_var($domain,FILTER_VALIDATE_DOMAIN))
            {
                die("Invalid Domain: $domain"); echo '<br>';
            }
            echo 'Valid Domain: ' .$domain;
        }
    }
}

Note that, on the html form, I put the domain input field as:

<label for="url">Url:</label><br>
<input type="text" 

I did this deliberately so the html5 doesn't give the error. I wanted php to give the error instead as got to learn how to filter url with php.

Q2. Why doesn't php's domain filter work ? Whenever I input a invalid url with an invalid domain: xxx.

I get echoed: Valid Domain: LINE: 27

<form method="POST" name="textfield" id="textfield" action="">
<fieldset>
<label for="url">Url:</label><br>
<input type="text" name="url" id="domain" maxlength="255" size="20">
<br>
<button type="submit">Submit Now!</button>
</form>

<?php


if($_SERVER['REQUEST_METHOD'] === 'POST')
{
    if(ISSET($_POST['url']))
    {
        $url = $_POST['url'];
        $domain = parse_url($url,PHP_URL_HOST);
        
        if(!filter_input(INPUT_POST,'url',FILTER_VALIDATE_DOMAIN))
        {
            echo "Invalid Domain: $domain"; echo '<br>';
            echo 'LINE: ' . __LINE__;
        }
        else
        {
            echo 'Valid Domain: ' .$domain;
            echo 'LINE: ' . __LINE__;
        }
    }
}

Very puzzling!

Answer 1

These filters just check whether the domain or URL is valid syntactically, according to the relevant standards.

FILTER_VALIDATE_DOMAIN checks that it's valid according to RFC 1034, RFC 1035, RFC 952, RFC 1123, RFC 2732, RFC 2181, and RFC 1123.

FILTER_VALIDATE_URL checks that it's valid according to RFC 2396.

They don't check that the domain actually exists, that the URL actually has a webserver, that the parameters are appropriate for the URL, etc.

So you can't use them to tell whether the URL is actually useful, just whether it looks like a URL.

Answer 2

Lets break down your sample URI

http://gvdvb.com/?mail=ali&bus=wertdomainn#wronghttp://gvdvb.com/?mail=ali&bus=wert(

The protocol: http://

The domain: gvdvb.com

The query string: mail=ali&bus=wertdomainn

And finally, the page anchor: wronghttp://gvdvb.com/?mail=ali&bus=wert(

While I personally would never use an anchor like that, it is still OK.

The PHP filter_var() for FILTER_VALIDATE_URL is based on the RFC 2396 - Uniform Resource Identifiers (URI)

These rules allow for prviate domains to be constructed (something I used on internal or local only networks often) as well as the expansion of the public domains without the need to re-write the rules when ever there is change.

The flexibility of the RFC is more important than a "fixed" rule. This does mean you can not confirm if a domain is a valid as in exists or valid as in formatted correctly.

If you want a valid as in exists rule you will need to write your own lookup query.

As to your code, yes, the PHP used will check if the format of the input is a valid URL, but not if the URL is publicly accessible.

And let's think about it, domains come and go all the time. If you wanted to check if a URL is accessible today, are you going to check again tomorrow to make sure it is still accessible?