[doc-en] master: `FILTER_VALIDATE_URL`: document lack of scheme validation

Author: Daniel Scherzer (DanielEScherzer) Date: 2026-09-20T14:44:34-07:00 Commit: https://github.com/php/doc-en/commit/d0aafe825288cf41b30bf0e44e4d4fa59e3dd873 Raw diff: https://github.com/php/doc-en/commit/d0aafe825288cf41b30bf0e44e4d4fa59e3dd873.diff FILTER_VALIDATE_URL: document lack of scheme validation Changed paths: M reference/filter/constants.xml Diff: diff --git a/reference/filter/constants.xml b/reference/filter/constants.xml index afcd1ce38dd9..6791e52d2b3b 100644 --- a/reference/filter/constants.xml +++ b/reference/filter/constants.xml @@ -621,7 +621,9 @@ will be accepted without any validation, though the presence of a host is still required unless the URL has a scheme of <literal>mailto:</literal>, <literal>news:</literal>, or - <literal>file:</literal>. + <literal>file:</literal>. Schemes are not themselves validated and may be + accepted despite not corresponding to a known URL scheme, or having some + other meaning in PHP (like <link linkend="book.phar">phar://</link>). </simpara> <informalexample> <programlisting role="php"> @@ -631,6 +633,9 @@ var_dump(filter_var('javascript://x%0aalert(1)', FILTER_VALIDATE_URL)); var_dump(filter_var('javascript://?demo', FILTER_VALIDATE_URL)); var_dump(filter_var('news:?demo', FILTER_VALIDATE_URL)); +var_dump(filter_var('phar://demo', FILTER_VALIDATE_URL)); +var_dump(filter_var('123://demo', FILTER_VALIDATE_URL)); +var_dump(filter_var('-://demo', FILTER_VALIDATE_URL)); ?> ]]> </programlisting> @@ -640,6 +645,9 @@ var_dump(filter_var('news:?demo', FILTER_VALIDATE_URL)); string(25) "javascript://x%0aalert(1)" bool(false) string(10) "news:?demo" +string(11) "phar://demo" +string(10) "123://demo" +string(8) "-://demo" ]]> </screen> </informalexample>