filter_var() accepts invalid URL

Question

Why does filter_var() accepts and validate this URL http://http://www.google.com?

$website = "http://http://www.google.com";

echo filter_var($website, FILTER_VALIDATE_URL); // This outputs the value of $website

I think this is wrong. Any solution or fixed for this?

phpinfo()

Answer 1

Seems like you've found a bug in PHP. The PHP manual states that FILTER_VALIDATE_URL validates uris according to http://www.faqs.org/rfcs/rfc2396.html

If you read the spec, PHP obviously fails to properly validate per the guidelines. Specifically, in section 3 (URI Syntactic Components), it's defined that the scheme (http in your case) may only exist once, and precedes the only colon in the uri.

You should report this bug at https://bugs.php.net/

Good work finding it!