setting class, type, name, id, or value on forms api #attributes on checkbox results in duplicate attributes

Any news about this problem?

Is/was this really a bug?

didn't mean to set this to fixed already.

Oww I get it. indeed, you're right.

function theme_checkbox($variables) {
...
  $checkbox .= 'type="checkbox" ';
  $checkbox .= 'name="' . $element['#name'] . '" ';
  $checkbox .= 'id="' . $element['#id'] . '" ' ;
  $checkbox .= 'value="' . $element['#return_value'] . '" ';
  // Unchecked checkbox has #value of numeric 0.
  if ($element['#value'] !== 0 && $element['#value'] == $element['#return_value']) {
    $checkbox .= 'checked="checked" ';
  }
  $checkbox .= drupal_attributes($element['#attributes']) . ' />';

First we're adding attributes to the string manually and then using drupal_attributes(). We could unset the manually added ones before drupal_attributes().

Pro
- No double attributes
- all attributes are handled the same
- all attributes are passed through check_plain() (security)

Contra
- all attributes are passed through check_plain(), while some don't need it (performance)

Oww some attributes can't be passed through check_plain(); especially URLs like the action attribute of <form>s.

Another way to fix duplicate attributes is removing them from #attributes.

Like this.

This issue reads a bit strange, as it started off with an entirely different question in 2005 (5.x), then changed its scope later on. Trying to address them one by one:

1) Setting a CSS class on #type 'checkbox' should be as simple as setting $element[#attributes][class][] = 'classname'. Note that 'class' is always an array in D7.

2) Certain attributes can indeed be set more than once. However, that would be a module developer mistake and I've personally never heard from anyone running into this problem. Furthermore, the patch over in #690980: Disabled form elements not properly rendered will eliminate this possibility by using #attributes only, and overriding those special attributes with the values of the internal element properties.

3) All HTML attributes *have to* be passed through check_plain(). What you encountered is actually the problem discussed and solved over in #715142: [beta blocker blocker] Various URLs escaped twice, since check_url() resp. filter_xss_bad_protocol() calls check_plain() -- certain attributes were escaped *twice*, which, in the case of URLs, can lead to double-encoded characters in the URL, effectively rendering it unusable.

4) The performance difference of invoking check_plain() for all attributes is only marginal and does not really count, compared to the improved consistency, and also importantly, vastly improved theme function code that can be overridden more easily.

In effect, I think this issue won't fix. Feel free to re-open.