I have a variable that picks up data from the theme settings like background image and such, and it's stored in a separate file with inline
$style = 'style="'.$background_image.$background_color.'"';
$background_color are just css values for
background_color that you can set in the options.
I'm using this variable in the header like
<header id="header" class="myheader" <?php echo $style; ?>>
Now this is not safe and should be sanitized, so I added
esc_attr() to escape the attribute.
<header id="header" class="myheader" <?php echo esc_attr( $style ); ?>>
This, in turn, made my double quotes into
" and the style didn't work of course. Now I could put
htmlspecialchars_decode() around the escaped value, but that kinda seems... odd.
Another solution would be to put the
style directly in the header, and only put the escaped values in, which would solve the double quote issue, but in the case that no styling has been set I'm left with an empty
style in my element, and that also seems kinda unnecessary.
What is the best solution out there?
Also if I use
htmlspecialchars_decode() I still get a phpcs error about escaping function and that is utterly annoying...