filter_var() accepts invalid URL

Question

Why does filter_var() accepts and validate this URL http://http://www.google.com?

$website = "http://http://www.google.com";

echo filter_var($website, FILTER_VALIDATE_URL); // This outputs the value of $website

I think this is wrong. Any solution or fixed for this?

phpinfo()

Melanesian

Why do you think the url is wrong? – Tricksy

@Tricksy There are two http://'s. – Spiller

Oops, my attention was stolen by com.ph in the end ) – Tricksy

How about checking if URL exists? – Ryannryazan

Answer 1

Seems like you've found a bug in PHP. The PHP manual states that FILTER_VALIDATE_URL validates uris according to http://www.faqs.org/rfcs/rfc2396.html

If you read the spec, PHP obviously fails to properly validate per the guidelines. Specifically, in section 3 (URI Syntactic Components), it's defined that the scheme (http in your case) may only exist once, and precedes the only colon in the uri.

You should report this bug at https://bugs.php.net/

Good work finding it!

Fiann