function url_is_external
url_is_external($path)
Returns TRUE if a path is external to Drupal (e.g. http://example.com).
If a path cannot be assessed by Drupal's menu handler, then we must treat it as potentially insecure.
Parameters
$path: The internal path or external URL being linked to, such as "node/34" or "http://example.com/foo".
Return value
Boolean TRUE or FALSE, where TRUE indicates an external path.
File
- includes/common.inc, line 2358
- Common functions that many Drupal modules will need to reference.
Code
function url_is_external($path) { $colonpos = strpos($path, ':'); // Some browsers treat \ as / so normalize to forward slashes. $path = str_replace('\\', '/', $path); // If the path starts with 2 slashes then it is always considered an external // URL without an explicit protocol part. return (strpos($path, '//') === 0) // Leading control characters may be ignored or mishandled by browsers, so // assume such a path may lead to an external location. The \p{C} character // class matches all UTF-8 control, unassigned, and private characters. || (preg_match('/^\p{C}/u', $path) !== 0) // Avoid calling drupal_strip_dangerous_protocols() if there is any slash // (/), hash (#) or question_mark (?) before the colon (:) occurrence - if // any - as this would clearly mean it is not a URL. || ($colonpos !== FALSE && !preg_match('![/?#]!', substr($path, 0, $colonpos)) && drupal_strip_dangerous_protocols($path) == $path); }
© 2001–2016 by the original authors
Licensed under the GNU General Public License, version 2 and later.
Drupal is a registered trademark of Dries Buytaert.
https://api.drupal.org/api/drupal/includes!common.inc/function/url_is_external/7.x