Attributes containing `"` cannot be parsed, even when escaped with `\`

[faytecCD]

Description

When using tag attributes, for example when the value of the name attribute contains a double quote ("), parsing fails even if the quote is escaped with a backslash (\) (added via addslashes).

This makes it impossible to use usernames or display names that contain double quotes.

Reproduction

[mention id=1 name="foo\"ff\""][/mention]

Expected Behavior

The value of name should be parsed as:

foo"ff"

Actual Behavior

Parsing fails and the original text is returned unchanged.

Impact

• Double quotes cannot be safely used inside attribute values

Notes

• Escaping with \" has already been tried
• The only possible workaround seems to be adjusting TOKEN_DELIMITER
• I am using RegularParser

Workaround

• Use content instead of an attribute

[mention id=1]foo"ff"[/mention]

This currently works.

[thunderer]

Hi @faytecCD - thank you for using my library and creating this issue. I reproduced and fixed it in #120 - could you please try dev-master and confirm it works for you before I tag a new minor?

[faytecCD]

Hi @thunderer

Sorry for the delay, and thank you for your work. I’ve tested this using the latest dev-master (see below ⬇️):

$ composer show thunderer/shortcode
name     : thunderer/shortcode
descrip. : Advanced shortcode (BBCode) parser and engine for PHP
keywords : bbcode, engine, library, parser, shortcode
versions : * dev-master
released : 2026-01-23, this week
type     : library
license  : MIT License (MIT) (OSI approved) https://spdx.org/licenses/MIT.html#licenseText
homepage :
source   : [git] https://github.com/thunderer/Shortcode.git 9dc01d8d7e4ae3d124c394b6bbb065d799b5781d
dist     : [zip] https://api.github.com/repos/thunderer/Shortcode/zipball/9dc01d8d7e4ae3d124c394b6bbb065d799b5781d 9dc01d8d7e4ae3d124c394b6bbb065d799b5781d
path     : /var/www/html/vendor/thunderer/shortcode
names    : thunderer/shortcode

The reproduction code is as follows:

$parser = new \Thunder\Shortcode\Parser\RegularParser;
$handlers = new \Thunder\Shortcode\HandlerContainer\HandlerContainer();
$handlers->add('mention', function (\Thunder\Shortcode\Shortcode\ShortcodeInterface $shortcode) {
    return $shortcode->getParameter('name');
});

$processor = new \Thunder\Shortcode\Processor\Processor($parser, $handlers);

$text = sprintf('Hi, [mention id=1234 name="%s"], good morning', addslashes('"John "Doe'));

dump($text);
// Hi, [mention id=1234 name="\"John \"Doe"], good morning
dump($processor->process($text));
// Hi, \"John \"Doe, good morning

The good news is that quotes are now correctly escaped. However, the value is rendered exactly as provided, including the escape character (\). That said, the tag itself is now parsed correctly, which is great.

To get the expected output, I can simply apply stripslashes() in the handler:

$parser = new \Thunder\Shortcode\Parser\RegularParser;
$handlers = new \Thunder\Shortcode\HandlerContainer\HandlerContainer();
$handlers->add('mention', function (\Thunder\Shortcode\Shortcode\ShortcodeInterface $shortcode) {
-    return $shortcode->getParameter('name');
+    return stripslashes($shortcode->getParameter('name'));
});

$processor = new \Thunder\Shortcode\Processor\Processor($parser, $handlers);

$text = sprintf('Hi, [mention id=1234 name="%s"], good morning', addslashes('"John "Doe'));

dump($text);
// Hi, [mention id=1234 name="\"John \"Doe"], good morning
dump($processor->process($text));
// Hi, "John "Doe, good morning

As shown above, adding stripslashes() produces the expected result. I’m just not entirely sure whether this is the intended or recommended approach.

Thank you.

[thunderer]

Yes, this is intended - this library focuses on getting the data verbatim to your handlers so that you can build exactly what you need, you're in control the whole time.

[faytecCD]

Thank you. This issue has now been resolved, so I can close this issue.