How to make a string safe for an href attribute using PHP?

Question

Would encoding quotation marks and removing eventual javascript: prefixes be enough?

P.S. Safe enough to defeat XSS attacks that is.

Your question is way toooooo unspecific to make clear what the term "safe" in the title stands for. You might want to filter protocol URLs thought, but then you should ask for that. Context is okay, but keep your question to the part you want to learn about. — hakre
– hakre, Commented Sep 3, 2013 at 18:14
well, then I'd like to make clear that removing the verbatim javascript: is not enough to prevent XSS in a href attribute. Instead I highly recommend you do some whitelisting here (that is far easier to implement and you don't need to be a super-pro to make this safe) — hakre
– hakre, Commented Sep 3, 2013 at 18:21
If you understand a bit into which direction I pointed to, why not formulate the answer your own, then ping me and I take a look? — hakre
– hakre, Commented Sep 3, 2013 at 18:28

Michael Valentino · Accepted Answer · 2013-09-03 18:08:06Z

1

you can use the php function to validate urls

$url = "http://google.com";
if (filter_var($url, FILTER_VALIDATE_URL)) {
  echo "URL is valid";
}
else {
  echo "URL is invalid";
}

answered Sep 3, 2013 at 18:08

Michael Valentino

1013 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Emanuil Rusev Over a year ago

I'm not interested in validation. I'm rather interested in making a string safe (sanitization) regardless of weather it is a valid URL or not.

jterry · Accepted Answer · 2013-09-03 18:13:39Z

0

Encoding with htmlspecialchars() with the ENT_QUOTES flag will technically make the URL safe/sanitary for use from an HTML perspective, but it does not guarantee that it'll create a valid address.

$url = 'http://invalid"url';
$url = htmlspecialchars($url, ENT_QUOTES); // Yields "http://invalid&quot;url"

answered Sep 3, 2013 at 18:13

jterry

6,2473 gold badges32 silver badges37 bronze badges

1 Comment

ComFreek Over a year ago

Using htmlspecialchars() makes the URI safe for using it in an HTML attribute. It guarantees valid HTML, but it does not help anything in regards of security (=the OP wants to protect the users from being presented with malicious JavaScript links).

Collectives™ on Stack Overflow

How to make a string safe for an href attribute using PHP?

2 Answers 2

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related