so I know about addslashes() and related native PHP functions, but I was surprised that I wasn't able to quickly find a WordPress "catch-all" for this kind of situation, given WordPress' focus on CMS.

I'm hoping there is something I can work in to all my metaboxes that solves this problem, as oppose to going in to every save and echo function and adding/removing slashes... or maybe there is a smarter way to do this when echoing out the data that I'm not thinking of.

The problem is pretty simple, I have a post meta box with a value with a quote (') and I echo it to the template like so:

echo "<input style='width:450px;' type='text' placeholder='The Title' name='the_title' value='".$val."'></input>";

The quote closes prematurely and therefore ruin's the HTML, because of the (') in $val.

So my question is do I need to go through my meta boxes and encode or add slashes and then go through my template and do the same thing in reverse for all of these potential cases... or what is a better way to think about this?


You need to escape the value for use in an HTML attribute with esc_attr():

echo "<input style='width:450px;' type='text' placeholder='The Title' name='the_title' value='" . esc_attr( $val ). "'></input>";

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.