It seems that CURLOPT_FAILONERROR obeys CURLOPT_FOLLOWLOCATION so if you set them both to true and just check if $response equals FALSE, a 302 code will be considered valid.

this is correct:
$code=intval($matches[1][(count($matches[1])-1)]);

The only reason I’m posting again is because I found another bug in the function, i hope you don’t mind WShadow, but I’m posting a complete fixed version of your function to help others out..

i modified it a bit for my personal usage, because a timeout doesn’t necessarily mean the page is invalid completely..could just be a temp server problem.

note: this function does not only grab headers, to me it’s not worth gaining the efficiency by running a script that sometimes fails..heh

function url_exists($url){
  /* this script will return:
    1 for a valid page
    2 for a timed out page
    3 for an invalid page
  */

  $parts=parse_url($url);
  if(!$parts) {
    return 3; /* the URL was seriously wrong */
  }

  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $url);

  /* set the user agent - might help, doesn't hurt */
  curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)');
  curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);

  /* try to follow redirects */
  curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

  /* timeout after the specified number of seconds. assuming that this script runs
    on a server, 20 seconds should be plenty of time to verify a valid URL.  */
  curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 15);
  curl_setopt($ch, CURLOPT_TIMEOUT, 20);

  /* don't download the page, just the header (much faster in this case) */
  curl_setopt($ch, CURLOPT_HEADER, true);

  /* handle HTTPS links */
  if($parts['scheme']=='https'){
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST,  1);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
  }

  $response = curl_exec($ch);
  $error = curl_error($ch);
  curl_close($ch);

  /*  get the LAST status code from HTTP headers */
  if(preg_match_all('/HTTP\/1\.\d+\s+(\d+)/', $response, $matches)){
    $code=intval($matches[1][(count($matches[1])-1)]);
  } else {
    if(eregi('operation timed out', $error)){
      //timed out
      return 2;
    }else {
      //not found
      return 3;
    }
  };

  /* see if code indicates success */
  if(($code>=200) && ($code<400)){
    //success
    return 1;
  }else {
    //not found
    return 3;
  }
}

Fact is i used the original function and i got invalid results, with urls that were prefectly fine being rejected as not valid. Leave NOBODY in tact and add HTTPGET and you have yourself a flawless script, great job.

I know some servers handle HEAD requests incorrectly, but I didn’t think it was common enough to leave out this option.