As Mario said, is better have a white list for allowed URLs. Added a long extensions list, from wikipedia :)