Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.I've just noted that form_clean_id() doesn't remove slashes, which are not allowed for IDs.
quote of the w3c xhtml 1.0 Recommendation:
Note that the collection of legal values in XML 1.0 Section 2.3, production 5 is much larger than that permitted to be used in the ID and NAME types defined in HTML 4. When defining fragment identifiers to be backward-compatible, only strings matching the pattern [A-Za-z][A-Za-z0-9:_.-]* should be used. See Section 6.2 of [HTML4] for more information.
The attached patch improves form_clean_id to follow this recommendation, except for the first character which isn't forced to be [A-Za-z].
| Comment | File | Size | Author |
|---|---|---|---|
| #11 | form_clean_id.patch | 498 bytes | liam morland |
| #4 | form.inc-189792-4.patch | 765 bytes | darren oh |
| #2 | drupal_clean_id2.patch | 642 bytes | fago |
| drupal_clean_id.patch | 625 bytes | fago |
Comments
Comment #1
JirkaRybka commentedSeems to me the brackets '][' will now produce two hyphens instead of one. That might be a problem (?)
Comment #2
fagoops, of course this would be a problem, thanks! Attached is an updated patch, which handles this case too.
Comment #3
ducdebreme commentedHow is the status of this patch? Why not including into the core HEAD?
It sound to be a good idea to have a positive filter on the ids...
Thanks
Stefan
Comment #4
darren ohUpdated to allow the process to be reversed if necessary.
Comment #5
darren ohComment #7
liam morlandWhat is wrong with the original patch?
If multiple hyphens in a row is a problem, then add
'/--+/'as a pattern to replace with'-'.Any reason why this fix can't also be made in D6?
Comment #8
darren ohThe problem with the original patch is that it doesn't handle all invalid characters. The Drupal 6 maintainers do not accept fixes that have not first been made in Drupal 7.
Comment #9
liam morlandThis code, from the patch, replaces with a hyphen all characters that are not valid in id attributes:
$id = preg_replace('/[^A-Za-z0-9:.-]/', '-', $id);.It also removes underscore, which it doesn't have to, but which is currently removed.
The only thing it doesn't do is guaranty that the first character is a letter, but that is probably not needed since strings coming through this function start with "edit-" or similar anyway.
Comment #10
darren ohSorry, I forgot. The only change in my patch was to make the process reversible. However, mine needs more work.
Comment #11
liam morlandAttached is the original patch, rerolled against D7. If it is not desirable to generate multiple hyphens in a row, a minor change to the regex will fix that.
Comment #13
liam morlandThis fix is being done as part of #464862: Add drupal_css_class() to clean class names and rename form_clean_id