note 124059 added to function.htmlspecialchars

If you use htmlspecialchars() to escape any HTML attribute, make sure use double quote instead of single quote for the attribute. For Example, > Wrap with Single Quote <?php echo "<p title='" . htmlspecialchars("Hello\"s\'world") . "'"> // title will end up Hello"s\ and rest of the text after single quote will be cut off. ?> > Wrap with Double quote : <?php echo '<p title="' . htmlspecialchars("Hello\"s\'world") . '"'> // title will show up correctly as Hello"s'world ?> ---- Server IP: 208.43.231.9 Probable Submitter: 82.199.157.54 (proxied: 38.104.247.178) ---- Manual Page -- http://php.net/manual/en/function.htmlspecialchars.php Edit -- https://master.php.net/note/edit/124059 Del: integrated -- https://master.php.net/note/delete/124059/integrated Del: useless -- https://master.php.net/note/delete/124059/useless Del: bad code -- https://master.php.net/note/delete/124059/bad+code Del: spam -- https://master.php.net/note/delete/124059/spam Del: non-english -- https://master.php.net/note/delete/124059/non-english Del: in docs -- https://master.php.net/note/delete/124059/in+docs Del: other reasons-- https://master.php.net/note/delete/124059 Reject -- https://master.php.net/note/reject/124059 Search -- https://master.php.net/manage/user-notes.php