function url_is_external

Returns TRUE if a path is external to Backdrop (e.g. http://example.com).

If a path cannot be assessed by Backdrop's menu handler, then we must treat it as potentially insecure.

Parameters

$path: The internal path or external URL being linked to, such as "node/34" or "http://example.com/foo".

Return value

Boolean TRUE or FALSE, where TRUE indicates an external path.:

File

core/includes/common.inc, line 2800

Common functions that many Backdrop modules will need to reference.

Code

function url_is_external($path) {
  $path = (string) $path;
  $colon_position = strpos($path, ':');
  // Some browsers treat \ as / so normalize to forward slashes.
  $path = str_replace('\\', '/', $path);
  // Avoid calling backdrop_strip_dangerous_protocols(). If the path starts with
  // 2 slashes then it is always considered an external URL without an explicit
  // protocol part.
  return (strpos($path, '//') === 0)
    // Leading control characters may be ignored or mishandled by browsers, so
    // assume such a path may lead to an external location. The \p{C} character
    // class matches all UTF-8 control, unassigned, and private characters.
    || (preg_match('/^\p{C}/u', $path) !== 0)
    // If there is any slash (/), hash (#) or question_mark (?) before the colon
    // (:) occurrence - if any - as this would clearly mean it is not a URL.
    || ($colon_position !== FALSE
    && !preg_match('![/?#]!', substr($path, 0, $colon_position))
    && backdrop_strip_dangerous_protocols($path) == $path);
}