a quick question about url validation

Question

I don't really want to use curl or anything complex like that. I was looking for a simple way to check if the url (User will enter the url and it is then stored in my MySQL database) is valid and that it is a valid url i.e. the domain exists. Is fopen a good solution?

Any tutorials or tips on this would be greatly appreciated.

Answer 1

You should try filter_var

<?php
$url = "http://www.example.com";

if(!filter_var($url, FILTER_VALIDATE_URL))
{
  echo "URL is not valid";
}
else
{
  echo "URL is valid";
}
?> 

Read the filter_var manual

Answer 2

CURL isn't that complex. To get the http status of a url:

$ch = curl_init('http://www.yahoo.com/');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if($status >= 200 && $status < 400) {
    // url is valid
}

A regex or filter would validate that the url is valid but not that it exists. A DNS lookup validates that the domain exists, but not the url.

Answer 3

First, validate that it is a valid URL using filter_var():

<?php

$url = "http://www.example.com/foo.php";

if(!filter_var($url, FILTER_VALIDATE_URL))
{
  die('Invalid URL');
}

Next, parse the URL with parse_url() and ensure that it is HTTP(S):

$p_url = parse_url($url);
if(!$p_url) // couldn't parse URL, since parse_url() cannot recognize it
{
  die('Invalid URL');
}
if($p_url['scheme'] != 'http' && $p_url['scheme'] != 'https')
{
  die('Invalid protocol (only HTTP(S) is supported)');
}

Lastly, check that the host exists and that you can connect to it. I choose to use fsockopen() here, since it would check the hostname and port, while not actually sending an HTTP request.

$fp = fsockopen($p_url['host'], (isset($p_url['port']) ? $p_url['port'] : 80));
if($fp)
{
  echo 'Valid URL';
  fclose($fp); // Remember to close the file pointer
}else{
  echo 'Invalid server';
}

Note that you might want to avoid using this method (depending on what you want your application to do), as if the server is down, this would result in Invalid server, even though the server might exist. An alternative solution that will only check the hostname from the DNS servers, and not connect at all, is using gethostbyaddr() and gethostbyname():

if(@gethostbyaddr($p_url['host'])) // IP addresses passes this test
{
  echo 'Valid URL';
}else{
  $host = $p_url['host'];
  $addr = gethostbyname($host);
  if(!$addr) // Invalid domain name
  {
    echo 'Invalid domain name';
  }else if($host == $addr) // Domain name could not be resolved (i.e. does not exist)
  {
    echo 'Invalid domain name';
  }else{
    echo 'Valid URL';
  }
}

Links:

• filter_var() - Validate strings
• parse_url() - Parses URLs into arrays
• fsockopen() - Opens a socket connection
• gethostbyaddr() - Gets the domain name of an IP address (not sure if it supports IPv6, though)
• gethostbyname() - Gets the IPv4 address of a domain name