$re = '/(?i)(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{){0,1}(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)[^\n]+/m';
$str = '${jndi:ldap://
${jndi:ldaps:/}
${jndi:rmi:/blarg
${jndi:dns://
${jndi:nis://
${jndi:iiop://
${jndi:corba://
${jndi:nds://
${jndi:http://
$jndi:https://
$ { JNDI :ANYPROTOCOL://
$ { JNDI :ANYPROTOCOL://
${jNDi:l%252564ap:/
Breakdown:
(?i) = case-insensitive
(%(25){0,}20|\\s)* = any number of spaces
(%(25){0,}24|\\$) = $
(%(25){0,}20|\\s)*
(%(25){0,}7B|{){0,1} = { zero or one time *Updated condition
(%(25){0,}20|\\s)*
(%(25){0,}(6A|4A)|J) = J
(%(25){0,}(6E|4E)|N) = N
(%(25){0,}(64|44)|D) = D
(%(25){0,}(69|49)|I) =I
(%(25){0,}20|\\s)*
(%(25){0,}3A|:) = :
[\\w\\%]+ = any number of any letters, url encoded or not
(%(25){0,}3A|:)
(%(25){0,}2F|\\/) = /
[^\\n]+ = until end of line
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php