[doc-en] master: `FILTER_VALIDATE_URL`: document when hosts are not required

Author: Daniel Scherzer (DanielEScherzer) Date: 2026-09-20T14:44:34-07:00 Commit: https://github.com/php/doc-en/commit/79796847b4d96eca12bbf7efaf4b07d1a66a4d5d Raw diff: https://github.com/php/doc-en/commit/79796847b4d96eca12bbf7efaf4b07d1a66a4d5d.diff FILTER_VALIDATE_URL: document when hosts are not required Changed paths: M reference/filter/constants.xml Diff: diff --git a/reference/filter/constants.xml b/reference/filter/constants.xml index 7706f3cb13f8..afcd1ce38dd9 100644 --- a/reference/filter/constants.xml +++ b/reference/filter/constants.xml @@ -571,7 +571,7 @@ <emphasis>DEPRECATED</emphasis> as of PHP 7.3.0 and <emphasis>REMOVED</emphasis> as of PHP 8.0.0. This is because it is always implied by the - <constant>FILTER_VALIDATE_URL</constant> filter. + <constant>FILTER_VALIDATE_URL</constant> filter for most schemes. </simpara> </warning> </listitem> @@ -618,7 +618,10 @@ <simpara> This filter is very permissive. For any scheme other than <literal>http://</literal> or <literal>https://</literal>, host content - will be accepted without any validation. + will be accepted without any validation, though the presence of a host + is still required unless the URL has a scheme of + <literal>mailto:</literal>, <literal>news:</literal>, or + <literal>file:</literal>. </simpara> <informalexample> <programlisting role="php"> @@ -626,6 +629,8 @@ <?php var_dump(filter_var('javascript://x%0aalert(1)', FILTER_VALIDATE_URL)); +var_dump(filter_var('javascript://?demo', FILTER_VALIDATE_URL)); +var_dump(filter_var('news:?demo', FILTER_VALIDATE_URL)); ?> ]]> </programlisting> @@ -633,6 +638,8 @@ var_dump(filter_var('javascript://x%0aalert(1)', FILTER_VALIDATE_URL)); <screen> <![CDATA[ string(25) "javascript://x%0aalert(1)" +bool(false) +string(10) "news:?demo" ]]> </screen> </informalexample>