bug report: tag links missing quotes

Hi @jb01,

Thank you for the feedback!

I have checked the mentioned file and this is the code that I can see in the file:

$html .= '<a href=' . esc_url( $tag_link ) . ' title="' . esc_attr( $tag->name ) . '" class=' . esc_attr( $tag->slug ) . ' rel="tag">';

In your provided code examples I actually can’t see any difference between the code as “it is now” and the one “as it should be” – could you double-check?

I also tried to check tags on the post with Neve theme and they are rendered correctly with working links.

You’re right, I think I copied the wrong section on the 1st time. I already overwrote that file so I dug it out of the original zip and it looks like this:

$html .= '<a href=' . esc_url( $tag_link ) . ' title="' . esc_attr( $tag->name ) . '" class=' . esc_attr( $tag->slug ) . ' rel="tag">';

Notice the “class” is missing wrapping quotation marks.

• This reply was modified 4 years, 1 month ago by jb01.

Hi @jb01,

Thank you for clarification, can you share a page where I can see the invalid formed HTML code on your website?

Code like this works just fine and class is rendered just fine during my tests. You can even make the same syntax for title too:

$html .= '<a href=' . esc_url( $tag_link ) . ' title=' . esc_attr( $tag->name ) . ' class=' . esc_attr( $tag->slug ) . ' rel="tag">';

And it works fine.

Looking forward to your reply if you can share an example where code is not rendered correctly.

Technically, you can get away without wrapping attributes in quotes according to the HTML spec, but it’s generally considered bad practice and can break HTML validation depending on the doctype used. Here are 2 references:
https://html.spec.whatwg.org/multipage/syntax.html#unquoted
https://stackoverflow.com/questions/13056683/html-attribute-with-without-quotes
Just because a modern browser can make up for malformed code, doesn’t mean it’s a good idea to rely on it.

As I already fixed this in my copy of the theme, so I don’t have a live version handy. I can look at your code and see where the quotation marks are missing pretty clearly.

$html .= '<a href="' . esc_url( $tag_link ) . '" title="' . esc_attr( $tag->name ) . '" class="' . esc_attr( $tag->slug ) . '" rel="tag">';

Hi @jb01,

Thank you for sharing the resources but in the shared resources I still don’t find that this is bad practice, it’s actually recommended to skip quotes where possible.

Attributes are placed inside the start tag and consist of a name and a value, separated by an = character. The attribute value can remain unquoted if it doesn’t contain spaces or any of " ' = < or >. Otherwise, it has to be quoted using either single or double-quotes. The value, along with the = character, can be omitted altogether if the value is the empty string.

That’s the reason there are quotes set for title attribute as it might have those special characters or spaces but the quotation is skipped for URL and class where a slug is used as those cannot have special characters.

I’m sorry if I’m missing something but if you can provide an example with what value the usage of tags might break that would be really helpful. Thanks again!

• This reply was modified 4 years, 1 month ago by Vytis.

I first discovered this issue is when a WP redirection plugin was scanning the site for 404 errors and detected this missing use of quotes as broken HTML. To be honest, there really is no good reason to avoid using quotes – if keeping the HTML code as small (and fast) as possible is the goal – the risk of it not being read by various parses, browsers, bots, etc is far too great by contrast. There is really no benefit to it – other than being stubborn. I took the time to report this issue, which most experienced web developers would notice and say “yep, you’re right, thanks” and move on. I don’t understand why you prefer to make an issue out of it. I’m sure there’s plenty of ways your time could be better spent on Neve.

Hi @jb01,

We appreciate you taking the time and reporting this, I’m sorry if it sounded like I’m arguing but I’m just checking the best practices recommended and tried to find if there can be any risks of not adding quotes to the mentioned attributes and I wasn’t able to image a scenario where those would cause an issue (as I mentioned quotes are skipped for attributes that cannot have special characters).

Just to be sure – I will double-check with our development team about this.

Thank you once again for spending your time reporting this and let us know if you have any other findings, recommendations, or questions!