This pattern is far too permissive. It will match URLs that are already in attributes, and will allow several invalid chars.