l() allows you to specify attributes that are added to the link tag, e.g. a title (l('Hello', 'node/1', array('options' => 'attributes' => array('title' => 'Welcome to the site', 'class' => 'hello-link'))).

The specified attributes are passed on to drupal_attributes() that takes care of check_plain'ing the values. But for some reason, l() calls strip_tags() on $options['attributes']['title']. This makes it impossible to specify a title containing something that looks like an HTML tag.

For instance, assume you have written an article about the <title> HTML tag and you want to link to it using l(). You want the generated HTML to look like this:

<a href="/node/1" title="Everything about the &lt;title&gt; tag">The &lt;title&gt; tag</a>

This is currently not possible. If you try calling l() with these parameters:

l('The <title> tag', 'node/1', array('attributes' => array('title' => 'Everything about the <title> tag')));
l('The <title> tag', 'node/1', array('attributes' => array('title' => 'Everything about the &lt;title> tag')));

you will end of with this:

<a href="/node/1" title="Everything about the  tag">The &lt;title&gt; tag</a>
<a href="/node/1" title="Everything about the &amp;lt;title&gt; tag">The &lt;title&gt; tag</a>

and that results in these two tooltips:

Everything about the  tag
Everything about the &lt;title> tag

The expected tooltip was this:

Everything about the <title> tag

The strip_tags() call was introduced in #186963: Links show ugly descriptions. The problem then was that the menu system is saving HTML into $options['attributes']['title'], and that array is saved into {menu_custom}.options and then passed this on to l(). I think the issue should have been fixed in the menu system instead of making a workaround in l().

This patch adds a new column, {menu_custom}.link_description, that contains the HTML description. The patch does not include a D6->D7 upgrade function and probably needs some additional testing.

What do you think of this approach? Is this too late for D7?

Comments

c960657’s picture

StatusFileSize
new15.47 KB

Status: Needs review » Needs work

The last submitted patch, l-strip-tags-1.patch, failed testing.

c960657’s picture

Status: Needs work » Needs review
StatusFileSize
new16.6 KB

Updated the tests.

pasqualle’s picture

StatusFileSize
new18.86 KB

the (html) menu description + (stripped) tooltip test looks good..

retester2010’s picture

#3: l-strip-tags-2.patch queued for re-testing.

Status: Needs review » Needs work

The last submitted patch, l-strip-tags-2.patch, failed testing.

damien tournoud’s picture

Priority: Minor » Normal

I support fixing this issue in D7.

lars toomre’s picture

This came up today in Drupal patch bingo.

Does this issue still need to be resolved or should it be closed?

Perhaps the way to move this forward is to write tests that check the conditions defined at the top of this issue?

c960657’s picture

Version: 7.x-dev » 8.x-dev
Status: Needs work » Needs review
StatusFileSize
new9.6 KB

It is still relevant. This is a reroll. The patch is still missing an update hook. Marking as "needs review" in order to get the test bot's opinion.

pillarsdotnet’s picture

Status: Needs review » Needs work
Issue tags: +Needs tests, +Needs backport to D7

Back to cnw for the update hook and tests.

pillarsdotnet’s picture

Status: Needs work » Needs review

#9: l-strip-tags-3.patch queued for re-testing.

c960657’s picture

StatusFileSize
new12.45 KB

Revived the old patch. Slightly different approach (I don't remember all the details). Let's see what the test bot has to say about it.

Status: Needs review » Needs work

The last submitted patch, l-strip-tags-4.patch, failed testing.

c960657’s picture

Status: Needs work » Needs review
StatusFileSize
new17.65 KB
jessebeach’s picture

StatusFileSize
new18.6 KB

I rerolled the patch. Got the following error when applying the patch in #14

Checking patch core/includes/common.inc...
Checking patch core/includes/menu.inc...
Checking patch core/modules/book/book.module...
Checking patch core/modules/menu/menu.admin.inc...
Checking patch core/modules/menu/menu.test...
error: while searching for:
    $edit = array(
      'link_path' => $link,
      'link_title' => $title,
      'description' => '',
      'enabled' => TRUE, // Use this to disable the menu and test.
      'expanded' => TRUE, // Setting this to true should test whether it works when we do the std_user tests.
      'parent' =>  $menu_name . ':' . $plid,

error: patch failed: core/modules/menu/menu.test:292
Checking patch core/modules/simpletest/tests/menu.test...
Checking patch core/modules/system/system.admin.inc...
Checking patch core/modules/system/system.install...
Checking patch core/modules/system/system.module...
Checking patch core/modules/toolbar/toolbar.module...
Applied patch core/includes/common.inc cleanly.
Applied patch core/includes/menu.inc cleanly.
Applied patch core/modules/book/book.module cleanly.
Applied patch core/modules/menu/menu.admin.inc cleanly.
Applying patch core/modules/menu/menu.test with 1 rejects...

We tested this patch through a fresh standard install without incident.

The behavior of the patch matches the description. Still looking at the code.

mgifford’s picture

#15: l_strip_tags-689672-15.patch queued for re-testing.

Status: Needs review » Needs work

The last submitted patch, l_strip_tags-689672-15.patch, failed testing.

dawehner’s picture

MHO for now we should just strip it, in case its not MarkupInterface

Version: 8.0.x-dev » 8.1.x-dev

Drupal 8.0.6 was released on April 6 and is the final bugfix release for the Drupal 8.0.x series. Drupal 8.0.x will not receive any further development aside from security fixes. Drupal 8.1.0-rc1 is now available and sites should prepare to update to 8.1.0.

Bug reports should be targeted against the 8.1.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.9 was released on September 7 and is the final bugfix release for the Drupal 8.1.x series. Drupal 8.1.x will not receive any further development aside from security fixes. Drupal 8.2.0-rc1 is now available and sites should prepare to upgrade to 8.2.0.

Bug reports should be targeted against the 8.2.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.3.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.4 was released on January 3, 2018 and is the final full bugfix release for the Drupal 8.4.x series. Drupal 8.4.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.5.0 on March 7, 2018. (Drupal 8.5.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.5.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)

Bug reports should be targeted against the 8.6.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.8.x-dev

Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

quietone’s picture

Version: 8.9.x-dev » 7.x-dev
Issue tags: +Bug Smash Initiative

l() was deprecated in Drupal 8.0.0, https://www.drupal.org/node/2346779. It is used in Drupal 7 so changing the version.

Status: Needs work » Closed (outdated)

Automatically closed because Drupal 7 security and bugfix support has ended as of 5 January 2025. If the issue verifiably applies to later versions, please reopen with details and update the version.