Escaping a string from database that goes on alt attribute

Question

This should be fairly easy but I don't see what I'm missing here:

I have my database and I want the alt attribute to be populated from it.

I have my code as follows:

  <img src="admin/uploads/retouch/'.$list->thumbnail.'" class="thumb-image" alt="'.utf8_encode(addslashes($list->titulo)).'" />

And it happens that in this case what's inside "titulo" in my database has " on it and I get this as a result in my code:

  <img ti!\""="" por="" ¡hazlo="" manos.="" en="" estÁ="" prestaciones="" tus="" mejorar="" alt="\" class="thumb-image" src="admin/uploads/retouch/noticia_default.png">

the sentence from database is: "MEJORAR TUS PRESTACIONES ESTÁ EN TUS MANOS. ¡HAZLO POR TI!"

possible duplicate of [What's the best practice to set html attribute via PHP?](http://stackoverflow.com/questions/2109583/whats-the-best-practice-to-set-html-attribute-via-php) — Jens, Apr 10 '14 at 05:24

score 8 · Accepted Answer · answered Jul 04 '11 at 08:24

8

You should be using htmlspecialchars not addslashes, with the utf8 option!

alt="'.htmlspecialchars($list->titulo, ENT_QUOTES, 'UTF-8').'"

answered Jul 04 '11 at 08:24

fire

21,383
17
79
114

Have you set utf-8 on the page? `` – fire Jul 04 '11 at 08:30
1

Also try adding `utf8_encode` around the `$list->titulo` if it's not properly encoded. – fire Jul 04 '11 at 08:32
Yeah, that utf8_encode did it, thank you very much, I learned something new today :D – Elaine Marley Jul 04 '11 at 08:35

score 1 · Answer 2 · answered Jul 04 '11 at 08:23

1

Use htmlentities or htmlspecialchars to escape strings in tag attributes.

answered Jul 04 '11 at 08:23

IvanGL

751
5
22

score 1 · Answer 3 · answered Jul 04 '11 at 08:23

1

You need to escape such content using PHP function htmlspecialchars().

answered Jul 04 '11 at 08:23

Gedrox

3,592
1
21
29

score 1 · Answer 4 · answered Jul 04 '11 at 08:24

1

You should encode htmlentities instead of adding slashes:

alt="'.htmlentities($list->titulo, ENT_QUOTES, 'UTF-8').'"

answered Jul 04 '11 at 08:24

Nicola Peluchetti

76,206
31
145
192

Escaping a string from database that goes on alt attribute

4 Answers4