开发者

Escaping a string from database that goes on alt attribute

This should be fairly easy 开发者_开发问答but I don't see what I'm missing here:

I have my database and I want the alt attribute to be populated from it.

I have my code as follows:

  <img src="admin/uploads/retouch/'.$list->thumbnail.'" class="thumb-image" alt="'.utf8_encode(addslashes($list->titulo)).'" />

And it happens that in this case what's inside "titulo" in my database has " on it and I get this as a result in my code:

  <img ti!\""="" por="" ¡hazlo="" manos.="" en="" estÁ="" prestaciones="" tus="" mejorar="" alt="\" class="thumb-image" src="admin/uploads/retouch/noticia_default.png">

the sentence from database is: "MEJORAR TUS PRESTACIONES ESTÁ EN TUS MANOS. ¡HAZLO POR TI!"


You should be using htmlspecialchars not addslashes, with the utf8 option!

alt="'.htmlspecialchars($list->titulo, ENT_QUOTES, 'UTF-8').'"


Use htmlentities or htmlspecialchars to escape strings in tag attributes.


You need to escape such content using PHP function htmlspecialchars().


You should encode htmlentities instead of adding slashes:

alt="'.htmlentities($list->titulo, ENT_QUOTES, 'UTF-8').'"
0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜