sanitization - How to make a string safe for an href attribute using PHP? -

would encoding quotation marks , removing eventual javascript: prefixes enough?

p.s. safe enough defeat xss attacks is.

you can use php function validate urls

$url = "http://google.com"; if (filter_var($url, filter_validate_url)) {   echo "url valid"; } else {   echo "url invalid"; }