|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2017-05-15 18:51 UTC] bj dot cardon at gmail dot com
Description:
------------
As the title says, the parse_url function allows backslashes to be in the hostname part of a URL and considers it valid. You can see the test script below showing this behavior.
Test script:
---------------
bcardon@bcardon-base:~$ php -a
Interactive mode enabled
php > $u = parse_url("https://www.example.com\\.google.com");
php > print_r($u);
Array
(
[scheme] => https
[host] => www.example.com\.google.com
)
Expected result:
----------------
The expected behavior is that invalid characters (including backslashes) will cause parse_url to return FALSE as with any invalid URL.
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Sat Oct 25 08:00:01 2025 UTC |
The underscores are only applied to control characters - guaranteed to be invalid everywhere. The docs should clarify that "invalid" does not consider what is allowed in each component. > not parse the URL in a nonsensical way parse_url tries to break the string into pieces in the most reasonable way it can figure. Mostly based on the presence of delimiters. Backslashes don't have significance, unlike : or / or ?, so they're ignored. If you think that a "nonsensical way" is parsing a string without validation then a "sensical way" would be parsing it *with* validation, and parse_url is only designed to do half of that. Parsing with validation is trivial: function parse_valid_url($url, $component = -1) { return filter_var($url, FILTER_VALIDATE_URL) ? parse_url($url, $component) : false; }