Shortcode won't take into account custom post ID put in parameter

Question

I wrote a little custom shortcode and when I try to use it in a custom post it won't take into account the parameter I set up.

What it's supposed to do

The shortcode is supposed to take a custom post ID into parameter and display a div that use the thumbnail of this post as a background if there's one, and then display the title of the post inside that DIV. Pretty simple stuff.

What it does

In front the shortcode appears to work as intended but don't take ID parameter into account and use current post ID to execute the function instead. The weird thing is that when I put a default value "4075" for $ID in the array it works fine. It just won't take the parameter into account when I set it with [lire-aussi ID="4075"]

The code

function shortcode_lire_aussi( $atts ){
        extract(
          shortcode_atts( array(
          'ID' => '',
        ), $atts));
    
        
          $title= get_the_title($ID);
          $linkURL= get_permalink($ID);
    
          if(has_post_thumbnail($ID)){
            $background = get_the_post_thumbnail_url( $ID );
            $output= '
            <div style = "background-image : url('.$background.');">
              <p>
                <a href="'.$linkURL.'">'.$title.'</a>
              </p>
          </div>';
          }
          else{
            $output= '
          <div style = "background-color : black;">
            <p>
              <a href="'.$linkURL.'">'.$title.'</a>
            </p>
          </div>';
          }
    
    
            return $output;
        
       
     
}
    
add_shortcode('lire-aussi', 'shortcode_lire_aussi');

I'm not really familiar with PHP and my knowledge of that language is very limited, I'm clearly missing something but can't figure what.

Answer 1

Shortcode attributes should be all lowercase

A Note on Security

There are 2 major security issues in your shortcode:

1. extract is dangerous as it can overwrite variables, it would be much safer to use $ID = ! empty( $atts['ID'] ) ? $atts['ID'] : null; instead. You might see this in a lot of examples but this is because copy pasting is popular and people are unaware, not because it's ok. Never use extract() under any circumstances if you value security and safety.
2. There is no escaping on your variables, when you output values you should escape dynamic values, e.g. <a href="'.$linkURL.'"> should be <a href="'.esc_url( $linkURL ).'">. This guarantees that only a URL can go in the href part, even if something malicious is inserted that tries to break out.

Answer 2

Looks like I solved the main issue ( the shortcode not fetching the right ID put as parameter) by renaming the variable inside the atts array. Apparantly it should always be in lower case: developer.wordpress.org/reference/functions/shortcode_atts