Please note the special occasions where they can fool your server inserting fake matches.
For example:
http://www.myserver.com/virus.exe?fakeParam=.jpg
Or
http://www.myserver.com/virus.exe#fakeParam=.jpg
I've modified quickly the regex to avoid this cases, but i'm pretty sure there could be more (like inserting %00 in the path of the file, for example, and cannot be easily parsed by a regex)
$matches = array();
preg_match_all('!http://[^?#]+.(?:jpe?g|png|gif)!Ui' , $string , $matches);
So, for security, use always regex in the most restrictive way, for example, if you know the server, write it into the regex, or if you know that the path always will include letters, hyphens, dots, slashes and numbers, use one expression like:
$matches = array();
preg_match_all('!http://[a-z0-9-./]+.(?:jpe?g|png|gif)!Ui' , $string , $matches);
This should avoid any funny surprise in the future.
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…