Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What characters should be escaped with their HTML entities. For example, & is escaped with &.

Should ' be escaped with '?

share|improve this question

I don't have comment privileges, or I would have left this as a comment on an earlier answer.

DO NOT, I repeat, DO NOT escape an apostrophe in HTML using

'

This is not a valid HTML character entity reference. It is an XML character entity reference. While Firefox and Chrome, at least, will render the above as an apostrophe in an HTML document, Internet Explorer will not. And it is following the standard when it refuses to do so.

You may escape an apostrophe in HTML using

'

But I don't believe it is, in general, necessary.

http://fishbowl.pastiche.org/2003/07/01/the_curse_of_apos/

http://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_references

share|improve this answer

I don't agree with Nate. You should ideally use as little escaping as possible and use UTF-8 to express characters natively. To do this you need an editor that can handle UTF-8 as well as a correct charset declaration, such as:

<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />

However, you should make it a habit to escape the characters that have a special meaning in (X)HTML, namely:

< &lt;
> &gt;
" &quot;
& &amp;
' &#39;

This will make sure you're not accidentally writing markup when you want to write these characters. This is especially important for user input, to maintain security. It's less obvious, but it's actually important to escape ". If a string ever ends up in a HTML attribute (title="something" etc.) the user could end the attribute and insert their own markup. Imagine what happens if the user enters " onclick="alert('hello'); and you insert that to title="..."

If you're using PHP, you can use the htmlspecialchars function to do this. Other languages may have other similar functions.

Update: I stand corrected on the apos issue. Damned pesky IE.

share|improve this answer
    
I've got two contradicting answers now. One recommends escaping ' and the other does not. What should I believe? – Tom Apr 18 '11 at 12:05
4  
In short. You may or may not escape it at your discretion. If you do, use &#39; not &apos;. If, for whatever reason, you use single quotes for a HTML attribute like title='something' you must obviously escape any single quotes inside that the attribute value. – nitro2k01 Apr 18 '11 at 21:32

It depends on your use case, but we should probably be discouraged from using ' in natural language generally, so the issue shouldn’t arise unless you have computer code in your XML.

Where we have strings translated, we find that some translators replace the closing quotes with the unicode curly quotes, but leave the straight quotes as the opening quotes, leaving them visually unbalanced and looking unprofessional.

The unicode characters and should replace ' where possible, much as and should replace ". This is useful because computers don’t recognise curly punctuation as special. (Although I'm amused to see that Stack Overflow/Chrome considers ‘don’t’ to be a spelling error, whereas it's happy with ‘don't’.)

It doesn't help that we have the very enticing ' and " characters right on the keyboard.

share|improve this answer

So let's see if StackExchange itself encodes an apostrophe using an HTML entity.

Here are some examples from the source code of this page.

(1) Question title: Encoded.

Should I escape the Apostrophe ( &#39; ) character with its HTML entity (&amp;#39;)?

(2) drew's answer: Not encoded.

But I don't believe it is, in general, necessary.

(3) Tom's comment on nitro2k01's answer: Encoded.

I&#39;ve got two contradicting answers now. One recommends escaping &#39; and the other does not. What should I believe?

So it goes both ways.

However, this page's source code never uses &apos;. All the encodings are of the form &#39;. This is consistent with nitro2k01 and drew's advice not to use &apos;.

share|improve this answer
1  
Although in all 3 instances it doesn't need to be HTML encoded. – w3dk Nov 10 '15 at 23:05

If your apostrophe belongs to content, escape it. Any other content characters that can be confused with code, escape it.

share|improve this answer
    
"If your apostrophe belongs to content, escape it." - This would seem to be incorrect (as if missing the word "don't"). If the apostrophe is part of content then don't escape it - there shouldn't be any need to. – w3dk Nov 10 '15 at 22:51

The easiest way to do the job without using the actual entity is to use PHP's htmlentities() or htmlspecialchars() functions:

$val = htmlspecialchars("Don't", ENT_QUOTES, 'UTF-8');
if($_POST){
  $val = htmlspecialchars(trim($_POST['val']), ENT_QUOTES, 'UTF-8');
}
echo "<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'> 
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en' class='njs'> 
  <head>
    <meta http-equiv='Content-type' content='text/html;charset=utf-8' />
    <title>Special Characters</title>
    <style type='text/css'>
      @import 'special.css';
    </style>
  </head>
<body>
  <form method='post' action='' id='fm' name='fm'>
    <input type='text' value='$val' name='val' id='val' />
    <input type='submit' value='submit' name='sub' id='sub' />
  </form>
</body>
  <script type='text/javascript' src='special.js'></script>
</html>";
share|improve this answer
3  
Is this a joke? – Su' Oct 17 '12 at 2:07
    
@Su' I'm afraid it isn't... – William D. Edwards Sep 11 '14 at 12:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.