How to make a string safe for an href attribute using PHP?

Question

Would encoding quotation marks and removing eventual javascript: prefixes be enough?

P.S. Safe enough to defeat XSS attacks that is.

Answer 1

you can use the php function to validate urls

$url = "http://google.com";
if (filter_var($url, FILTER_VALIDATE_URL)) {
  echo "URL is valid";
}
else {
  echo "URL is invalid";
}