I think the 'solution' will depend on how paranoid you want to be about security. You could count the occurrences of protocol tags and if it's more than one, do

I think the 'solution' will depend on how paranoid you want to be about security. You could count the occurrences of protocol tags and if it's more than one, don't allow the user to submit it -- however, this would break some url redirectors and print pages. Or, you could do what you said, and check the string for consecutive protocol tags, then discard all of them except the last one. Since there is a fairly low volume of new links that need to be checked, PG could simply add a few lines of code that send an HTTP HEAD request to the url and see if it's really a valid link before accepting it (or try a HEAD, then a GET if that fails, in case the webserver doesn't handle HEAD requests properly). I think that would be the most flexible solution.