diff --git a/Fields/Field.php b/Fields/Field.php index 2a6ac4a..123c149 100644 --- a/Fields/Field.php +++ b/Fields/Field.php @@ -314,7 +314,7 @@ public function getHtml() $html = 'attributes as $name => $value) { - $html.= $name.'="'.$value.'" '; + $html.= $name.'="'.htmlspecialchars($value).'" '; } if ($this->required) { diff --git a/tests/FormTests.php b/tests/FormTests.php index 1b90c4d..2b651db 100644 --- a/tests/FormTests.php +++ b/tests/FormTests.php @@ -261,6 +261,24 @@ public function testAccessingNotExistingField() $form->getField('titi'); } + public function testQuotesAttributes() + { + $form = $this->getForm('quotes.html'); + $field = $form->getField('xxx'); + + $this->assertTrue($field->hasAttribute('foo')); + $this->assertEquals($field->getAttribute('foo'), 'bar baz "bax"'); + + $doc = new DOMDocument(); + $doc->loadHTML("$form"); + $element = $doc->getElementById('theinput'); + + $this->assertFalse($element == null); + $this->assertTrue($element->hasAttribute('foo')); + $this->assertEquals($element->getAttribute('foo'), 'bar baz "bax"'); + + } + public function testPlaceholder() { $form = $this->getForm('placeholder.html'); diff --git a/tests/files/form/quotes.html b/tests/files/form/quotes.html new file mode 100644 index 0000000..2b5a927 --- /dev/null +++ b/tests/files/form/quotes.html @@ -0,0 +1,3 @@ +