How to safely output HTML from a PHP program?

Question

When doing this job in PHP,one may meet this kind of issue:

<span title="<?php echo $variable;?>">...

The problem is that if $variable contains double quotes,should change it to \"

And that's not the whole story yet:

<span title='<?php echo $variable;?>'>...

In this case,we need to change single quotes to \',but leave double quotes as is.

In addition, variable values may contain angle brackets < and > that will interfere with HTML.

So how can we safely escape output for HTML?

Dominic Rodger · Accepted Answer · 2013-09-26T14:44:55.530

108

You always want to HTML-encode things inside HTML attributes, which you can do with htmlspecialchars:

<span title="<?php echo htmlspecialchars($variable); ?>">

You probably want to set the second parameter ($quote_style) to ENT_QUOTES.

The only potential risk is that $variable may already be encoded, so you may want to set the last parameter ($double_encode) to false.

edited Sep 26 '13 at 14:44

answered Jan 21 '10 at 13:46

Dominic Rodger

2

Confirmed with html5 specs here: http://stackoverflow.com/questions/5320177/what-values-can-i-put-in-an-html-attribute-value – e-motiv Jan 31 '14 at 23:46
1

+1 for mentioning "ENT_QUOTES". I was already using the this function but double quotes would mess up the html. – danielson317 Aug 17 '17 at 16:55
Note that ENT_QUOTES will still cause errors in javascript within html: link Use addslashes first and then htmlspecialchars to fix this issue. – Leigh Bicknell Mar 14 '19 at 11:27
@LeighBicknell I think it is better to do `htmlspecialchars(json_encode($variable), ENT_QUOTES)`. I haven't tested it in your particular example, but I think it should work nicely for any type of value. – frodeborli Mar 25 '21 at 12:11
Since PHP8.1 `ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401` is the default value. – Tobias K. Nov 28 '22 at 14:50

score 3 · Answer 2 · answered Jan 21 '10 at 13:48

3

Well, before you output any text into HTML you should escape it using htmlspecialchars(). So just make sure (double) quote is correctly changed.

Pay attention to the second parameter of that function.

answered Jan 21 '10 at 13:48

Crozin

score -1 · Answer 3 · answered Oct 28 '15 at 05:26

-1

The Bat tool has a StringTool::htmlAttributes ( $arrayOfAttributes ) method that does the job too.

answered Oct 28 '15 at 05:26

ling

3 Answers3