Attributes containing " cannot be parsed, even when escaped with \ #119

Activity

1. thunderer

   closed this as completedin #120on Jan 23, 2026
2. thunderer

   self-assigned this

   on Jan 23, 2026
3. thunderer

   added

   bug

   on Jan 23, 2026
4. thunderer commented on Jan 23, 2026

   

   thunderer

   on Jan 23, 2026

   Owner

   More actions

   Hi @faytecCD - thank you for using my library and creating this issue. I reproduced and fixed it in #120 - could you please try dev-master and confirm it works for you before I tag a new minor?
5. thunderer

   reopened this on Jan 23, 2026
6. faytecCD commented on Jan 26, 2026

   

   faytecCD

   on Jan 26, 2026

   Author

   More actions

   Hi @thunderer

   Sorry for the delay, and thank you for your work. I’ve tested this using the latest dev-master (see below ⬇️):

   $ composer show thunderer/shortcode
   name     : thunderer/shortcode
   descrip. : Advanced shortcode (BBCode) parser and engine for PHP
   keywords : bbcode, engine, library, parser, shortcode
   versions : * dev-master
   released : 2026-01-23, this week
   type     : library
   license  : MIT License (MIT) (OSI approved) https://spdx.org/licenses/MIT.html#licenseText
   homepage :
   source   : [git] https://github.com/thunderer/Shortcode.git 9dc01d8d7e4ae3d124c394b6bbb065d799b5781d
   dist     : [zip] https://api.github.com/repos/thunderer/Shortcode/zipball/9dc01d8d7e4ae3d124c394b6bbb065d799b5781d 9dc01d8d7e4ae3d124c394b6bbb065d799b5781d
   path     : /var/www/html/vendor/thunderer/shortcode
   names    : thunderer/shortcode

   The reproduction code is as follows:

   $parser = new \Thunder\Shortcode\Parser\RegularParser;
   $handlers = new \Thunder\Shortcode\HandlerContainer\HandlerContainer();
   $handlers->add('mention', function (\Thunder\Shortcode\Shortcode\ShortcodeInterface $shortcode) {
       return $shortcode->getParameter('name');
   });
   
   $processor = new \Thunder\Shortcode\Processor\Processor($parser, $handlers);
   
   $text = sprintf('Hi, [mention id=1234 name="%s"], good morning', addslashes('"John "Doe'));
   
   dump($text);
   // Hi, [mention id=1234 name="\"John \"Doe"], good morning
   dump($processor->process($text));
   // Hi, \"John \"Doe, good morning

   The good news is that quotes are now correctly escaped. However, the value is rendered exactly as provided, including the escape character (\). That said, the tag itself is now parsed correctly, which is great.

   To get the expected output, I can simply apply stripslashes() in the handler:

   $parser = new \Thunder\Shortcode\Parser\RegularParser;
   $handlers = new \Thunder\Shortcode\HandlerContainer\HandlerContainer();
   $handlers->add('mention', function (\Thunder\Shortcode\Shortcode\ShortcodeInterface $shortcode) {
   -    return $shortcode->getParameter('name');
   +    return stripslashes($shortcode->getParameter('name'));
   });
   
   $processor = new \Thunder\Shortcode\Processor\Processor($parser, $handlers);
   
   $text = sprintf('Hi, [mention id=1234 name="%s"], good morning', addslashes('"John "Doe'));
   
   dump($text);
   // Hi, [mention id=1234 name="\"John \"Doe"], good morning
   dump($processor->process($text));
   // Hi, "John "Doe, good morning

   As shown above, adding stripslashes() produces the expected result. I’m just not entirely sure whether this is the intended or recommended approach.

   Thank you.
7. thunderer commented on Jan 29, 2026

   

   thunderer

   on Jan 29, 2026

   Owner

   More actions

   Yes, this is intended - this library focuses on getting the data verbatim to your handlers so that you can build exactly what you need, you're in control the whole time.

   👍React with 👍1Reacted by faytecCD
8. faytecCD commented on Jan 30, 2026

   

   faytecCD

   on Jan 30, 2026

   Author

   More actions

   Thank you. This issue has now been resolved, so I can close this issue.
9. faytecCD

   closed this as completedon Jan 30, 2026