Usage of the_title () and the_title_attribute () functions

However, many developers do not realize that this function should not be used here, that is, in attributes, such:

<A href = "<? Php the_permalink ();?> "Title =" <? Php the_title ();?> "> Continue reading <? Php the_title ();?> </A>

Many developers use this method in loop, page, and post to set up a hyperlink to a specified article. It seems that there is no problem, but in fact, the correct and secure method should put title =""Rewrite to title =""

Why do you want to write it like this? Let's take a look at the core function files in the WordPress source file:

The_title () source code:

/*** Display or retrieve the current post title with optional content. ** @ since 0.71 ** @ param string $ before Optional. content to prepend to the title. * @ param string $ after Optional. content to append to the title. * @ param bool $ echo Optional, default to true. whether to display or return. * @ return null | string Null on no title. string if $ echo parameter is false. */function the_title ($ before = '', $ after ='', $ echo = true) {$ title = get_the_title (); if (strlen ($ title) = 0) return; $ title = $ before. $ title. $ after; if ($ echo) echo $ title; else return $ title ;}

This function does not provide us with valid information. It only executes the get_the_title () function. Let's look at the related files of this function.

/*** Retrieve post title. ** If the post is protected and the visitor is not an admin, then "Protected" * will be displayed before the post title. if the post is private, then * "Private" will be located before the post title. ** @ since 0.71 ** @ param mixed $ post Optional. post ID or object. * @ return string */function get_the_title ($ post = 0) {$ post = get_post ($ post); $ title = isset ($ pos T-> post_title )? $ Post-> post_title: ''; $ id = isset ($ post-> ID )? $ Post-> ID: 0; if (! Is_admin () {if (! Empty ($ post-> post_password) {$ protected_title_format = apply_filters ('protected _ title_format ', _ ('protected: % S ')); $ title = sprintf ($ protected_title_format, $ title);} else if (isset ($ post-> post_status) & 'private' = $ post-> post_status) {$ private_title_format = apply_filters ('private _ title_format ', _ ('private: % S'); $ title = sprintf ($ private_title_format, $ title );}} return apply_filters ('The _ title', $ title, $ id );}

This function is very simple. It uses get_post () to retrieve the post object and passes it to a filter called the_title. The $ post-> post_title is returned.

The most important part of this function is apply_filters ('The _ title', $ title, $ id );

This filter can be used to customize the output format of titles for developers, such as adding additional html tags.

The_title_attribute () source code:

/*** Sanitize the current title when retrieving or displaying. ** Works like {@ link the_title ()}, parameters t the parameters can be in a string or * an array. see the function for what can be override in the $ args parameter. ** The title before it is displayed will have the tags stripped and {@ link * esc_attr ()} before it is passed to the user or displayed. the default * as with {@ link the_title ()}, is to display the title. ** @ since 2.3.0 ** @ param string | array $ args Optional. override the defaults. * @ return string | null Null on failure or display. string when echo is false. */function the_title_attribute ($ args = '') {$ title = get_the_title (); if (strlen ($ title) = 0) return; $ defaults = array ('before' => '', 'after' =>'', 'echo '=> true); $ r = wp_parse_args ($ args, $ defaults); extract ($ r, EXTR_SKIP); $ title = $ before. $ title. $ after; $ title = esc_attr (strip_tags ($ title); if ($ echo) echo $ title; else return $ title ;}

This function also uses the get_the_title () function to retrieve the title of the article, but the final returned data is different from the the_title () function. Many escape characters and html tags are filtered out, which can be used in Element attributes more securely.

Example:

Assume that your $ post-> post_title is like this.

<Span class = "title"> This is the title with the span tag </span>

When you use the the_title () function, the output will remain unchanged.

<Span class = "title"> This is the title with the span tag </span>

However, when you use the_title_attribute (), your output is as follows:

This is the title with the span label.

Note that the span tag has been removed.

If your title contains double quotation marks

This is a title with "double quotation marks"

When you use the the_title () function, the output is as follows:

This is a title with "double quotation marks"

However, when you use the the_title_attrubute () function, the output is as follows:

This is a title with \ "double quotation marks \"

Note that double quotation marks are automatically replaced with escape characters, which ensures the safe use of html tag attributes.

If we use the the_title () function in the html tag attribute, the original form of the attribute will be damaged.

<Span title = "<? Php the_title ();?> "> <? Php the_title ();?> </Span>

The output will be as follows:

<Span title = "this is a title with" double quotation marks "> This is a title with" double quotation marks "</span>

Note that the quotation marks of the title attribute here. html tags are very strict in the use of quotation marks. If such a format is prohibited, serious page display problems may occur.

So the correct usage should be:

<A href = "<? Php the_permalink ();?> "Title =" <? Php the_title_attribute ();?> "> Continue reading <? Php the_title ();?> </A>

After the above analysis, developers are expected to pay attention to these small details in the future development process. In the html tag attributes, the the_title_attribute () function must be used instead of the the_title () function!