Categories
language-agnostic regex url

What is the best regular expression to check if a string is a valid URL?

969

How can I check if a given string is a valid URL address?

My knowledge of regular expressions is basic and doesn’t allow me to choose from the hundreds of regular expressions I’ve already seen on the web.

3

  • 41

    Any URL or just HTTP? E.g. does mailto:[email protected] count as a URL? A a AIM chat link?

    – Mecki

    Oct 2, 2008 at 11:01

  • 5

    If a URL has no leading “http(etc)”, how would you be able to distinguish it from any other arbitrary string that happens to have dots in it? Say something like “MyClass.MyProperty.MyMethod”? Or “I somtimes miss the spacebar.is this a problem?”

    – Tomalak

    May 7, 2009 at 8:51

  • 13

    Microsoft has a Regex page that includes an expression for URLs. Surely a good start: msdn.microsoft.com/en-us/library/ff650303.aspx NB. The above page is retired, but the expressions in the table are essentially still valid for reference. The URL expression recommended (and which worked great for me) is: “^(ht|f)tp(s?)\:\/\/[0-9a-zA-Z]([-.\w]*[0-9a-zA-Z])*(:(0-9)*)*(\/?)([a-zA-Z0-9\-\.\?\,\’\/\\\+&%\$#_]*)?$”

    – CMH

    Feb 1, 2012 at 23:39


176

I’ve just written up a blog post for a great solution for recognizing URLs in most used formats such as:

The regular expression used is:

/((([A-Za-z]{3,9}:(?:\/\/)?)(?:[-;:&=\+\$,\w][email protected])?[A-Za-z0-9.-]+|(?:www.|[-;:&=\+\$,\w][email protected])[A-Za-z0-9.-]+)((?:\/[\+~%\/.\w-_]*)?\??(?:[-\+=&;%@.\w_]*)#?(?:[\w]*))?)/

2

  • 28

    That one also works, but it’s missing support for the port number (useful in debugging). Modified would be /((([A-Za-z]{3,9}:(?:\/\/)?)(?:[-;:&=\+\$,\w][email protected])?[A-Za-z0-9.-]+(:[0-9]+)?|(?:www.|[-;:&=\+\$,\w][email protected])[A-Za-z0-9.-]+)((?:\/[\+~%\/.\w-_]*)?\??(?:[-\+=&;%@.\w_]*)#?(?:[\w]*))?)/

    Mar 15, 2013 at 8:58

  • 21

    Got another match mate: width:210px; and margin:3px

    – Cas Bloem

    Feb 7, 2014 at 15:29


85

What platform? If using .NET, use System.Uri.TryCreate, not a regex.

For example:

static bool IsValidUrl(string urlString)
{
    Uri uri;
    return Uri.TryCreate(urlString, UriKind.Absolute, out uri)
        && (uri.Scheme == Uri.UriSchemeHttp
         || uri.Scheme == Uri.UriSchemeHttps
         || uri.Scheme == Uri.UriSchemeFtp
         || uri.Scheme == Uri.UriSchemeMailto
            /*...*/);
}

// In test fixture...

[Test]
void IsValidUrl_Test()
{
    Assert.True(IsValidUrl("http://www.example.com"));
    Assert.False(IsValidUrl("javascript:alert('xss')"));
    Assert.False(IsValidUrl(""));
    Assert.False(IsValidUrl(null));
}

(Thanks to @Yoshi for the tip about javascript:)

9

  • 8

    Uri.TryCreate() returns true if it’s valid

    Apr 1, 2009 at 9:03

  • 127

    A HUGE warning to anyone who uses this technique: System.Uri correctly accepts javascript: alert('blah'). You need to do further validation on Uri.Scheme to confirm the http/https/ftp protocol is being used, otherwise if such a URL is inserted into your ASP.NET pages’ HTML as a link, your users are vulnerable to XSS attacks.

    – Yoshi

    Aug 10, 2011 at 5:25


  • 26

    Notably, Uri.TryCreate returns true for empty strings as well. It appears that TryCreate isn’t very effective…

    May 9, 2012 at 14:26

  • 2

    what if I need a regex to do server/client-side in an ASP.NET MVC app? How would this help me on the client?

    May 30, 2013 at 15:56

  • 5

    For .Net, use Uri.IsWellFormedUriString()

    – mheyman

    Aug 23, 2015 at 18:12