Finaly one have to check the parts of the URL for valid signs. This is all what one can do.
Possible for the IP based one can check for wrong values (386.99.0.1 is not possible)

There are so many optional parts ...

Also limitations are bad. To have a point in the host limits two things (just out of the hip):

local servers
For example some e mail clients reject user@localhost. They need user@SLD.TLD. I have my own local mail server running, what do I need a TLD for?

Fixed IP6. There is no point in it.

So for that I vote for prohibited chars.
Again, this is not simple. Chars valid in a domain are not valid in a IPV4 are not valid in a IPV6 and vice versa. There is only one @ in a user:pasword@host, no : in a domain (separator to port) but several in an IPV6 and so on.


The most simple is run the string against the web. If there is some return the syntax seems to be fine. HTTP error codes need to be checked for site response. (watch out for HTTP error code 451. Site exists - but not for you. )

>I think the important question is what the URL validation is used for. The only times I have needed such validation, have been for storing static URLs, like home pages, facebook accounts and similar stuff. The client wanted some notification when seemingly wrong URLs were entered, but if the "probably wrong URL" warning was ignored, the entered value was accepted.
>
>
>>It's the question what to test. Valid URL or existence of a connection?
>>
>>Valid URL is a pain.
>>
>>http://user:password@fee.foo:1234/path/file?ask=not#Target0
>>
>>Is perfectly valid syntax for a URL...
>>
>>localhost
>>is valid
>>http://[::1]
>>is valid
>>https:/127.0.0.1
>>is valid
>>https://shop.heise.de/sonstiges/../.
>>is valid.
>>
>>We have umlaut domains right now - and one would expect that the input box will recieve öüä and translate them accordingly. (Even I think it's a fail)
>>
>>One can just get the URL, do (in a second field or on every use) the translations one need to deal with umlaut etc. And try if one need it if one can reach the host.
>>
>>Syntax check will not solve the problem of moving targets. :)
>>
>>>Since a website can be down at the moment and they are frequently changed, I wouldn't include a check for the presence of the URL in a validation function.