$str = 'http://blah.com"onclick="alert(document.cookie)';
var_dump(is_url($str));

function is_url($url) {
    return (preg_match('#^(https?):\/\/#i', $url) && (filter_var($url, FILTER_VALIDATE_URL) !== FALSE));
}