Maybe adding a simple "^" at the begining of the regex should be enough :) /^https?:\/\/([-\w\.]+)+(:\d+)?(\/([\w/_\.]*(\?\S+)?)?)?/ Otherwise, could be

Maybe adding a simple "^" at the begining of the regex should be enough :) /^https?:\/\/([-\w\.]+)+(:\d+)?(\/([\w/_\.]*(\?\S+)?)?)?/ Otherwise, could be used for XSS. Like this url (http://naurls.me/39696e http://naurls.me/39696e): javascript:<script>alert('HELLO world');</script>http://naurl.me/