Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Azoruk's avatar

Laravel Blade adding domain in front of external URLs

On my website, users can share URLs.

These are stored as a text type in my database.

These links are displayed like so:

<a href="{{ $submission->link }}" rel="nofollow">{{$submission->title}}</a>

The problem with this is that blade adds the domain in front of URL if an href is detected.

So if the link is www.google.comit'll look like http://localhost/www.google.com

However if the link is https://www.google.com it'll work fine.

A solution I saw when I searched this problem is to put // at the start of the href, like so:

<a href="//{{ $submission->link }}" rel="nofollow">{{$submission->title}}</a>

This works fine for links that start with www., but if I do https://www.google.com the URL will look like this:

https//www.google.com

Notice the lack of :

What's the most elegant solution to this problem? Do I remove https before storing to the database? Do I make it so that if there's an https, I print the link as normal, but if there's no https I add //?

0 likes
6 replies
Snapey's avatar

Its the client browser that does this. Nothing to do with Laravel or blade

If a href does not start with a protocol then it is assumed to be local to the current site.

You need to check the link when it is given to you, and if it starts http:// ot https:// then leave it alone, otherwise add http:// to the url before you save it in the database.

Force the URL to lowercase before you check incase they gave HTTP:// or even hTTp://

Cronix's avatar
Cronix
Best Answer
Level 67

Check them when saving into the db. Either reject them through validation if the link doesn't start with http/https, or just add it in before saving. Then everything will be consistent when you output.

Azoruk's avatar

but what if the URL being shared doesn't use https? How do I know if the URL is going to be http or https if they don't provide it

Cronix's avatar

If they don't provide, just go with http. Any decent website will redirect http to https, if it runs https, so that's the best default.

Please or to participate in this conversation.