views:

2102

answers:

5

Often when writing PHP I'll have it output some HTML like this -

echo "<a href="../" title="link title">".$link_text."</a>";

Obviously this won't parse as I need to escape the double quotes in the attributes of the <a> element. Is there a regex that would quickly do this rather than me manually adding the backslashes?

One other thing - the regex shouldn't escape double quotes outside of the tag (e.g. where I've appended the $link_text variable.

Any ideas?

+6  A: 

You should just use single-quotes instead:

echo '<a href="../" title="link title">' . $link_text . '</a>';
Greg
not to forget htmlspecialchars($link_text)
Tomalak
I disagree with htmlspecialchars inline when printing, by the time you print all arguments should already be clean.
joebert
anyway, @joebert, htmlspecialchars must be used before printing :)
Maciej Łebkowski
Thanks - looks like switching to single quotes is the simple (and possibly fastest?) solution. Also - appreciate the concern about cleaning output using htmlspecialchars(). I left it out of the example code for clarity.
Phil
yes, most likely the single quotes method would be the fastest
Maciej Łebkowski
in addition, you can use "," instead of "." with echo. this will avoid string concatenation and will be even faster (works only with echo)
Maciej Łebkowski
"I left it out of the example code for clarity" -- please don't do this! It causes bad practises by newbies who just copy and paste code from examples.
Peter Boughton
+3  A: 

Use (This syntax dont worry about quotes etc)

echo <<<EOT
<a href="../" title="link title">$link_text</a>
EOT;
Ish Kumar
I think that the outer quotes are not meant to appear there.
Svante
sorry my mistake
Ish Kumar
A: 

I'd strongly suggest using templating instead of trying to build strings.

In raw PHP:

<a href="../" title="link title"><?php echo $link_text; ?></a>
David Dorward
Point taken - though there's times when I just want to quickly output a small string of HTML (from say a function or method) and using a templating engine is a bit overkill.
Phil
+4  A: 

Solutions I can come up with (not without escaping):

  • Single quotes

    echo '<a href="../">' . $link_text. '</a>';
    
  • Use double quotes

    echo "<a href='../'>$link_text</a>";
    
  • Sprintf

    echo sprintf('<a href="../">%s</a>', $link_text);
    
  • Use HEREDOC

    echo <<<EOF
    <a href="../">$link_text</a>
    EOF;
    
  • Use template engine like smarty

  • Exit PHP-mode:

    ?><a href="../"><?php echo $link_text ?></a><?php // other code...
    

BTW, be sure to use htmlspecialchars() on $link_text variable, or you’ll have a XSS security hole.

Maciej Łebkowski
Thanks - looks like switching to single quotes is the simple (and possibly fastest?) solution. Also - appreciate the concern about the cleaning output using htmlspecialchars(). I left it out of the example code for clarity.
Phil
A: 

**this Line not work properly /r work but $siteurl/%s-%s.html not work i think problem of ("") or ('') please help me to repair it

printf("<a href='/r?%s' target=_blank onClick='window.open(location.href=$siteurl/%s-%s.html)>", $wurl, $myrow["wallpaperid"], $myrow["wallpapername"]);**
Hassan