esc_attr() WP 2.8.0
Escaping for HTML attributes. Converts <, >, &, ", '
characters to HTML entities. Does not make double escaping.
The function is intended to convert a raw string into a valid one for output in HTML attributes.
Works based on: _wp_specialchars()
Basis of: esc_attr_e(), esc_attr__()
1 time = 0.000001s = speed of light | 50000 times = 0.17s = very fast | PHP 7.2.5, WP 4.9.8
Hooks from the function
Return
String. Escaped string for use in HTML attributes.
Usage
<?php echo esc_attr( $text ) ?>
- $text(string) (required)
- Raw text for conversion.
Examples
#1 Example of usage
$text = "<span>(tag) '(quote) \"(double quote) &(ampersand)"; echo esc_attr( $text ); // returns: // <span>(tag) '(quote) "(double quote) &(ampersand)
#2 Example of double conversion
$text = "> and &"; echo esc_attr( $text ); // > and & echo htmlspecialchars( $text ); // &gt; and &amp;
#3 Data cleaning on output
<?php $fname = ( isset( $_POST['fname'] ) ) ? $_POST['fname'] : ''; ?> <input type="text" name="fname" value="<?php echo esc_attr( $fname ); ?>">
Changelog
Since 2.8.0 | Introduced. |
Code of esc_attr() esc attr WP 5.6
function esc_attr( $text ) {
$safe_text = wp_check_invalid_utf8( $text );
$safe_text = _wp_specialchars( $safe_text, ENT_QUOTES );
/**
* Filters a string cleaned and escaped for output in an HTML attribute.
*
* Text passed to esc_attr() is stripped of invalid or special characters
* before output.
*
* @since 2.0.6
*
* @param string $safe_text The text after it has been escaped.
* @param string $text The text prior to being escaped.
*/
return apply_filters( 'attribute_escape', $safe_text, $text );
}Related Functions
From tag: esc_ (clean validate sanitize)
More from category: Sanitizing, Escaping
- sanitize_email()
- sanitize_file_name()
- sanitize_html_class()
- sanitize_option()
- sanitize_post_field()
- sanitize_text_field()