UrlHelper

Parses an array into a valid, rawurlencoded query string.

Function rawurlencode() is RFC3986 compliant, and as a consequence RFC3987 compliant. The latter defines the required format of "URLs" in HTML5. urlencode() is almost the same as rawurlencode(), except that it encodes spaces as "+" instead of "%20". This makes its result non compliant to RFC3986 and as a consequence non compliant to RFC3987 and as a consequence not valid as a "URL" in HTML5.

Filters a URL query parameter array to remove unwanted elements.

Parses a URL string into its path, query, and fragment components.

This function splits both internal paths like @code node?b=c#d @endcode and external URLs like @code https://example.com/a?b=c#d @endcode into their component parts. See

Encodes a Drupal path for use in a URL.

For aesthetic reasons slashes are not escaped.

Determines whether a path is external to Drupal.

An example of an external path is http://example.com. If a path cannot be assessed by Drupal's menu handler, then we must treat it as potentially insecure.

Determines if an external URL points to this installation.

Processes an HTML attribute value and strips dangerous protocols from URLs.

Gets the allowed protocols.

Sets the allowed protocols.

Strips dangerous protocols (for example, 'javascript:') from a URI.

This function must be called for all URIs within user-entered input prior to being output to an HTML attribute value. It is often called as part of \Drupal\Component\Utility\UrlHelper::filterBadProtocol() or \Drupal\Component\Utility\Xss::filter(), but those functions return an HTML-encoded string, so this function can be called independently when the output needs to be a plain-text string for passing to functions that will call Html::escape() separately. The exact behavior depends on the value:

• If the value is a well-formed (per RFC 3986) relative URL or absolute URL that does not use a dangerous protocol (like "javascript:"), then the URL remains unchanged. This includes all URLs generated via Url::toString().
• If the value is a well-formed absolute URL with a dangerous protocol, the protocol is stripped. This process is repeated on the remaining URL until it is stripped down to a safe protocol.
• If the value is not a well-formed URL, the same sanitization behavior as for well-formed URLs will be invoked, which strips most substrings that precede a ":". The result can be used in URL attributes such as "href" or "src" (only after calling Html::escape() separately), but this may not produce valid HTML (for example, malformed URLs within "href" attributes fail HTML validation). This can be avoided by using Url::fromUri($possibly_not_a_url)->toString(), which either throws an exception or returns a well-formed URL.

Verifies the syntax of the given URL.

This function should only be used on actual URLs. It should not be used for Drupal menu paths, which can contain arbitrary characters. Valid values per RFC 3986.