Escaping a string from database that goes on alt attribute
This should be fairly easy 开发者_开发问答but I don't see what I'm missing here:
I have my database and I want the alt attribute to be populated from it.
I have my code as follows:
<img src="admin/uploads/retouch/'.$list->thumbnail.'" class="thumb-image" alt="'.utf8_encode(addslashes($list->titulo)).'" />
And it happens that in this case what's inside "titulo" in my database has " on it and I get this as a result in my code:
<img ti!\""="" por="" ¡hazlo="" manos.="" en="" estÁ="" prestaciones="" tus="" mejorar="" alt="\" class="thumb-image" src="admin/uploads/retouch/noticia_default.png">
the sentence from database is: "MEJORAR TUS PRESTACIONES ESTÁ EN TUS MANOS. ¡HAZLO POR TI!"
You should be using htmlspecialchars
not addslashes
, with the utf8 option!
alt="'.htmlspecialchars($list->titulo, ENT_QUOTES, 'UTF-8').'"
Use htmlentities or htmlspecialchars to escape strings in tag attributes.
You need to escape such content using PHP function htmlspecialchars().
You should encode htmlentities instead of adding slashes:
alt="'.htmlentities($list->titulo, ENT_QUOTES, 'UTF-8').'"
精彩评论