When I write HTML tags, I tend to put things in single-quotes, i.e. class='foo'. When I go to make a link on here, <a href='http://foo.com'>foo</a> doesn't work, but <a href="http://foo.com">foo</a> does. Since both are valid, could both be accepted?

Using single-quotes: http://foo.com'>foo

Using double-quotes: foo

  • 6
    [link text](http-address) ? – yo' Mar 1 '13 at 17:56
  • I'm not saying there aren't other ways to make links, I'm asking if an existing one can be expanded – DiMono Mar 1 '13 at 18:03
  • 3
    I'm not saying it is a bad idea. However, considering how easy it is to put a link into anywhere on SE (posts, comments, chat), it has a low impact/prize ratio. – yo' Mar 1 '13 at 18:10

Any changes to the HTML sanitizer's whitelist, with all the security considerations that entails, need a very good reason, and given that there are tons of different ways to create links (with hand-crafted HTML being the lest common one anyway, for good reasons), I don't see adding yet another (even less common) way to be a very good reason.


According to the FAQ on allowed HTML, double quotes are required:

You must enter the tags exactly as shown. Any deviation from this list—adding extra spaces, using single quote or no quotes, etc.—means the tag will be stripped.

However, that's not quite how HTML hyperlinks are supposed to be stripped when they are invalid. That behavior is another side-affect of balpha's changes to the hyperlink regex which now auto-linkifies things even when immediately surrounded by other characters.

Currently, the regex only looks for an equals sign followed by a double quotation (=") as a preceding character set. Since a single quote is not, the entire link gets automatically linkified like so:

<a href='<http://foo.com>'>foo</a>
         ^              ^

which produces this HTML:

<a href='<a href="http://foo.com">http://foo.com</a>'>foo</a>

which for some reason, when added to the post directly, actually creates a link followed by the '>foo, but in reality should create the result you're getting. When the check runs to remove invalid HTML, the main components of it are removed:

<a href='<a href="http://foo.com">http://foo.com</a>'>foo</a>

and you are left with:

  • 1
    This is not supposed to work, and it never was. – balpha Mar 1 '13 at 18:29
  • @balpha: If it's not, then shouldn't you remove the HTML first before messing it all up? I honestly don't see why it shouldn't work. – animuson Mar 1 '13 at 18:30
  • Actually, tweaking the regex to not auto-linkify after a single quote would still fix this for your by-design view, as the HTML would still get stripped properly in the end since the extra link isn't there. – animuson Mar 1 '13 at 18:35
  • I'm considering it (I already made that change to Discourse), and it makes sense for the general case, but for the Stack Overflow case it doesn't really matter; you're just creating two different kinds of being broken. – balpha Mar 1 '13 at 18:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .