Escape double quotes of HTML attributes output by PHP

Question

Often when writing PHP I\'ll have it output some HTML like this -

echo \"\".$link_text.\"\";
         


        

Answer 1

Solutions I can come up with (not without escaping):

• Single quotes

  echo '' . $link_text. '';
  

• Use double quotes

  echo "$link_text";
  

• Sprintf

  echo sprintf('%s', $link_text);
  

• Use HEREDOC

  echo <<$link_text
  EOF;
  

• Use template engine like smarty

• Exit PHP-mode:

  ?>

BTW, be sure to use htmlspecialchars() on $link_text variable, or you’ll have a XSS security hole.