PHP strpos验证

Question

I am using the strpos function to validate a url that is submitted by a user and I want to make sure I'm not missing anything that would allow the user to bypass the validation and submit a url that is inappropriate.

Take the following as an example, if I only want a user to be able to input a url associated with the youtube domain, I don't want them to be able to put a wildcard (*) or something in that would "trick" the strpos function.

$url = $request->input('url');

// Check if Youtube url is found

if (strpos($url, 'http://youtube.com') > -1)
{
    // some code    
}

// some code

Thanks!

Answer 1

strpos returns false when in a not found condition and 0 if the string appears in the first column, which also looks like false to PHP, so it would be more accurate to use === or !==

$url = $request->input('url');
// Check if Youtube url is found

if (strpos($url, 'http://youtube.com') !== FALSE)
{
    // some code when youtube is found in url
}