Escaping " with \ on an HTML tag is not working

Question

My final code looks like this:

<a href="/galleries/hairtinsels/hairtinsel/hairtinsels.jpg" rel="shadowbox[gallery]" title="Hair Tinsels, 24 Colour Choices, 36\" Long">

Note the 36\" part - the " is escaped with a \ so it should work, right? No, on shadowbox the title cuts off and just says:

Hair Tinsels, 24 Colour Choices, 36\

This is mind-boggling... any ideas?

This was escaped using addslashes() function in PHP - this gallery is generated by PHP looping through an array.

Answer 1

You need the right escaping function for each context. And within HTML, you do need htmlspecialchars(). The quote within double quotes should be ". (The common C string escapes with the backslash don't work in HTML/XML/SGML.)

Quite commonly you need the charset parameter too:

 htmlspecialchars($string, ENT_QUOTES, "UTF-8");
 // and ENT_QUOTES just in case you had single quote attributes