如何阻止javascript：//作为url参数

Question

I'm currently writing a PHP script for a guestbook in PHP where people can put their name, website and messages in a form, but I want to prevent someone from putting javascript:// in de url box to reduce the risk of XSS, I've tried to solve this with:

<?php filter_var($_POST['website'], FILTER_VALIDATE_URL) ?>

But I'm still able of putting javascript:// in de url box how could I prevent this?

Answer 1

with preg_replace

$website = preg_replace("/(javascript:\/\/)/i", "http://", mysql_real_escape_string($_POST['website']));

or with str_ireplace

$website = str_ireplace("javascript:", "http:", mysql_real_escape_string($_POST['website']));