开发者

Escaping a string from database that goes on alt attribute

开发者 https://www.devze.com 2023-03-17 15:40 出处:网络
This should be fairly easy 开发者_开发问答but I don\'t see what I\'m missing here: I have my database and I want the alt attribute to be populated from it.

This should be fairly easy 开发者_开发问答but I don't see what I'm missing here:

I have my database and I want the alt attribute to be populated from it.

I have my code as follows:

  <img src="admin/uploads/retouch/'.$list->thumbnail.'" class="thumb-image" alt="'.utf8_encode(addslashes($list->titulo)).'" />

And it happens that in this case what's inside "titulo" in my database has " on it and I get this as a result in my code:

  <img ti!\""="" por="" ¡hazlo="" manos.="" en="" estÁ="" prestaciones="" tus="" mejorar="" alt="\" class="thumb-image" src="admin/uploads/retouch/noticia_default.png">

the sentence from database is: "MEJORAR TUS PRESTACIONES ESTÁ EN TUS MANOS. ¡HAZLO POR TI!"


You should be using htmlspecialchars not addslashes, with the utf8 option!

alt="'.htmlspecialchars($list->titulo, ENT_QUOTES, 'UTF-8').'"


Use htmlentities or htmlspecialchars to escape strings in tag attributes.


You need to escape such content using PHP function htmlspecialchars().


You should encode htmlentities instead of adding slashes:

alt="'.htmlentities($list->titulo, ENT_QUOTES, 'UTF-8').'"
0

精彩评论

暂无评论...
验证码 换一张
取 消