The quote mark that opens an attribute value is not closed before the parser encounters a <
, >
, or balancing "
or '
.
![]() | <img src="janedoe.png" alt="Jane Doe /> |
![]() | <img src="janedoe.png" alt="Jane Doe" /> |
![]() | <img src="example.png" alt="" title="Example of the <code> element" /> |
![]() | <img src="example.png" alt="" title="Example of the <code> element" /> |
![]() | <img src='johndoecar.png' alt='John Doe's car' /> |
![]() | <img src='johndoecar.png' alt='John Doe's car' /> |
![]() | <img src="johndoecar.png" alt="John Doe's car" /> |
Add any missing quote marks, and be sure reserved characters are escaped properly.
This may be tricky in dynamically generated markup. Some languages provide a tidy function, e.g. PHP htmlspecialchars. In Javascript, it is necessary to include a routine to search and replace reserved characters.