SMM Panel Invalid Link Error: 10 Causes and Solutions

PHP Example: Validate a Social Media URL Before an API Request

Developers can perform basic URL validation before sending information to an upstream provider.

The following PHP example checks whether a submitted URL uses HTTPS and belongs to one of several expected platform hostnames.

It does not verify that content exists or that a particular service accepts the URL.

<?php

function validateSocialUrl(string $url): bool
{
    $url = trim($url);

    if (!filter_var($url, FILTER_VALIDATE_URL)) {
        return false;
    }

    $parts = parse_url($url);

    if (!is_array($parts)) {
        return false;
    }

    $scheme = strtolower($parts['scheme'] ?? '');
    $host = strtolower($parts['host'] ?? '');

    if ($scheme !== 'https') {
        return false;
    }

    if (isset($parts['user']) || isset($parts['pass'])) {
        return false;
    }

    $allowedHosts = [
        'instagram.com',
        'www.instagram.com',
        'tiktok.com',
        'www.tiktok.com',
        'vm.tiktok.com',
        'youtube.com',
        'www.youtube.com',
        'm.youtube.com',
        'youtu.be',
        't.me',
    ];

    return in_array($host, $allowedHosts, true);
}

$url = 'https://www.instagram.com/exampleaccount/';

echo validateSocialUrl($url)
    ? 'Basic URL format accepted'
    : 'Invalid or unsupported URL';

What This Code Does

The function checks:

• Whether the supplied value resembles a valid URL
• Whether HTTPS is used
• Whether the hostname is in the allowed list
• Whether URL-embedded credentials are absent

It intentionally does not follow redirects or request remote content.

What This Code Does Not Do

It does not determine:

• Whether the account exists
• Whether the content is public
• Whether the selected service expects a profile or post
• Whether the provider allows the URL
• Whether a URL is safe for a later network-fetch operation

It also supports only the explicitly listed hostnames.

Additional official platform domains or URL structures may need to be handled according to the application’s requirements.

Developer security note: If your application fetches user-submitted URLs or follows redirects, apply separate network-layer protections against server-side request forgery. Hostname validation by itself is not sufficient.