$re = '/url\s*\(\s*[\'"]?(?!(((?:https?:)?\/\/)|(?:data\:?:)))([^\'"\)]+)[\'"]?\s*\)/';
$str = '#TEST {
background:url(test.jpg);
background:url( \'test.jpg\' );
background:url("test.jpg" );
background:url(http://example.com/test.jpg);
background:url(\'https://example.com/test.jpg\');
background:url("http://example.com/test.jpg");
background:url( \'//example.com/test.jpg\' );
background:url( "//example.com/test.jpg" );
background:url(//example.com/test.jpg);
}';
$subst = "url(\"/themes/default/css/$3\")";
$result = preg_replace($re, $subst, $str);
echo "The result of the substitution is ".$result;
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php