Simple Validation to Prevent XSS

In its current form you can inject `javascript:` and presumably `data:` urls in most of the JSON url fields. The below validation proposal, while simple, should prevent at least vectors involving invalid urls in the StackOverflow or Magento Certification fields.

Updated to allow a few different forms of StackExchange url.
Don't you need to pass in the `true` parameter to `json_decode()`, in order for `$data` to be an array?