Pinging the user requested host - is this code insecure?
Your regular expression for detecting valid urls is very weak and you can slip a lot past it.

Though you have used escapeshellcmd() to protect yourself a bit from people trying to run alternative commands you have not protected yourself from people sending extra parameters to ping. 

Two alternative attacks spring to mind:


You can overload your servers by making them send lots of useless packets in the ping requests.
You can use your servers as the host for an attack on somebody else.


An example of sending extra bytes with ping (I put your script in the file test.php on myhost (not real name).

http://myhost.com/test.php?host=plop.com%20-s%20500

Generates:

ping -n 0 plop.com -s 500