Why is `'` escaped in html libs?

Question

With HTML I notice some libraries escape '. My question is why? The first time I thought maybe they did it just because but I seen more then one do it but not all. I can't remember what I looked at from the top of my head but the others i remember were &, <, >, ".

I know & is used for escape characters (such as to make & which is &). < and > are escaped to not be confused for start/end tags and " is done so you can put " in tag attributes if you need to for some reason. But why '? Also am I missing any other characters that should be escaped?

http://en.wikipedia.org/wiki/HTML_entity#Character_entity_references_in_HTML — Matt Ball, Mar 12 '13 at 02:46
See also: http://stackoverflow.com/a/273604/362536 and http://stackoverflow.com/a/10371514/362536 — Brad, Mar 12 '13 at 02:47
possible duplicate of [Are single quotes allowed in HTML?](http://stackoverflow.com/questions/273354/are-single-quotes-allowed-in-html) — guido, Mar 12 '13 at 02:49

score 4 · Accepted Answer · answered Mar 12 '13 at 02:48

4

Because under HTML, the single-quote character ' can be used to delimit element attributes instead of the double-quote, like so:

<p class='something'></p>

However the character does not need to be escaped normally, but it's best to be safe.

answered Mar 12 '13 at 02:48

Dai

141,631
28
261
374

score 2 · Answer 2 · answered Mar 12 '13 at 02:49

2

In HTML, " and ' are interchangeable. Both can be used for setting the attribute for an element as well as used for denoting a string in JavaScript:

<img src="bob.png" />

<img src='bob.png' />

answered Mar 12 '13 at 02:49

scott.korin

2,537
2
23
36

score 1 · Answer 3 · answered Mar 12 '13 at 02:49

The single-quote mark is escaped because it can only be used as-is in certain contexts. When writing an escaping function, it is easier and faster to just always escape it, so you don't have to take into account the context.

For example, if you use double quotes " to denote an attribute value, you can use a single quote ' within it safely. However, if you use single quotes to denote the attribute value, you cannot.

Why is `'` escaped in html libs?

3 Answers3