check_url

check_url($uri)

Strips dangerous protocols from a URI and encodes it for output to HTML.

Parameters

$uri: A plain-text URI that might contain dangerous protocols.

Return value

string A URI stripped of dangerous protocols and encoded for output to an HTML attribute value. Because it is already encoded, it should not be set as a value within a $attributes array passed to Drupal\Core\Template\Attribute, because Drupal\Core\Template\Attribute expects those values to be plain-text strings. To pass a filtered URI to Drupal\Core\Template\Attribute, call \Drupal\Component\Utility\UrlHelper::stripDangerousProtocols() instead.

See also

\Drupal\Component\Utility\UrlHelper::stripDangerousProtocols()

\Drupal\Component\Utility\UrlHelper::filterBadProtocol()

Related topics

Sanitization functions

Functions to sanitize values.

File

core/includes/common.inc, line 224

Common functions that many Drupal modules will need to reference.

Code

function check_url($uri) {
  return Html::escape(UrlHelper::stripDangerousProtocols($uri));
}