I'm now doing it this way:
<a title="<?php echo $title; ?>">...
But it will brreak when " is included in $title.
Add a comment
|
3 Answers
Not that it's "the final solution", but obviously you need to escape any literal string that isn't mean to contain HTML. In this case:
<a title="<?php echo htmlspecialchars($title); ?>">
2 Comments
Mottie
Actually you can have HTML in the title attribute. Just make sure you replace all quotes with "... I've used this jQuery tooltip (cssglobe.com/post/1695/…) and I have included all types of HTML markup.
Lukáš Lalinský
Yes, well, you can in HTML and you can't in XHTML. Even in HTML, you need to escape the ampersand so that it's not evaluated as an entity. In general it's a better idea to escape everything, even if you are using HTML. It shouldn't affect the tooltip plugin, because it's looking at the parsed value, not the raw HTML file.
Comments
You should translate special characters into HTML entities first, easily done with htmlentities().
<a title="<?php echo htmlentities($title); ?>">
1 Comment
Etienne Dechamps
Don't use htmlentities() if you don't have to. Use htmlspecialchars() instead. htmlentities() will encode some chars even if we don't need to, thus wasting space.