code/string/escaper/escaper.php
public static  function escapeAttr($string)
    {
        if ($string !== '' && !ctype_digit($string))
        {
            $matcher = function($matches)
            {
                $chr = $matches[0];
                $ord = ord($chr);

                /**
                 * Replace undefined characters
                 *
                 * Replace characters undefined in HTML with the hex entity for the Unicode
                 * replacement character.
                 */
                if (($ord <= 0x1f && $chr != "\t" && $chr != "\n" && $chr != "\r")
                    || ($ord >= 0x7f && $ord <= 0x9f)
                ) {
                    return '&#xFFFD;';
                }

                /**
                 * Replace name entities
                 *
                 * If the current character to escape has a name entity replace it with while
                 * grabbing the integer value of the character.
                 */
                if (strlen($chr) > 1) {
                    $chr = static::convertEncoding($chr, 'UTF-16BE', 'UTF-8');
                }

                $hex = bin2hex($chr);
                $ord = hexdec($hex);
                if (isset(static::$_entity_map[$ord])) {
                    return '&' . static::$_entity_map[$ord] . ';';
                }

                /**
                 * Per OWASP recommendation
                 *
                 * Use upper hex entities for any other characters where a named entity does
                 * not exist.
                 */
                if ($ord > 255) {
                    return sprintf('&#x%04X;', $ord);
                }

                return sprintf('&#x%02X;', $ord);
            };

            $string = preg_replace_callback('/[^a-z0-9,\.\-_]/iSu', $matcher, $string);
        }

        return $string;
    }
public static  function escapeAttr($string)
    {
        if ($string !== '' && !ctype_digit($string))
        {
            $matcher = function($matches)
            {
                $chr = $matches[0];
                $ord = ord($chr);

                /**
                 * Replace undefined characters
                 *
                 * Replace characters undefined in HTML with the hex entity for the Unicode
                 * replacement character.
                 */
                if (($ord <= 0x1f && $chr != "\t" && $chr != "\n" && $chr != "\r")
                    || ($ord >= 0x7f && $ord <= 0x9f)
                ) {
                    return '&#xFFFD;';
                }

                /**
                 * Replace name entities
                 *
                 * If the current character to escape has a name entity replace it with while
                 * grabbing the integer value of the character.
                 */
                if (strlen($chr) > 1) {
                    $chr = static::convertEncoding($chr, 'UTF-16BE', 'UTF-8');
                }

                $hex = bin2hex($chr);
                $ord = hexdec($hex);
                if (isset(static::$_entity_map[$ord])) {
                    return '&' . static::$_entity_map[$ord] . ';';
                }

                /**
                 * Per OWASP recommendation
                 *
                 * Use upper hex entities for any other characters where a named entity does
                 * not exist.
                 */
                if ($ord > 255) {
                    return sprintf('&#x%04X;', $ord);
                }

                return sprintf('&#x%02X;', $ord);
            };

            $string = preg_replace_callback('/[^a-z0-9,\.\-_]/iSu', $matcher, $string);
        }

        return $string;
    }
public static function escapeAttr ( $ string ) { if ( $ string !== '' && ! ctype_digit ( $ string ) ) { $ matcher = function ( $ matches ) { $ chr = $ matches [ 0 ] ; $ ord = ord ( $ chr ) ; /**
                 * Replace undefined characters
                 *
                 * Replace characters undefined in HTML with the hex entity for the Unicode
                 * replacement character.
                 */ if ( ( $ ord <= 0x1f && $ chr != "\t" && $ chr != "\n" && $ chr != "\r" ) || ( $ ord >= 0x7f && $ ord <= 0x9f ) ) { return '&#xFFFD;' ; } /**
                 * Replace name entities
                 *
                 * If the current character to escape has a name entity replace it with while
                 * grabbing the integer value of the character.
                 */ if ( strlen ( $ chr ) > 1 ) { $ chr = static :: convertEncoding ( $ chr , 'UTF-16BE' , 'UTF-8' ) ; } $ hex = bin2hex ( $ chr ) ; $ ord = hexdec ( $ hex ) ; if ( isset ( static :: $ _entity_map [ $ ord ] ) ) { return '&' . static :: $ _entity_map [ $ ord ] . ';' ; } /**
                 * Per OWASP recommendation
                 *
                 * Use upper hex entities for any other characters where a named entity does
                 * not exist.
                 */ if ( $ ord > 255 ) { return sprintf ( '&#x%04X;' , $ ord ) ; } return sprintf ( '&#x%02X;' , $ ord ) ; } ; $ string = preg_replace_callback ( '/[^a-z0-9,\.\-_]/iSu' , $ matcher , $ string ) ; } return $ string ; }
Escape Html Attribute

This method uses an extended set of characters o escape that are not covered by htmlspecialchars() to cover
cases where an attribute might be unquoted or quoted illegally (e.g. backticks are valid quotes for IE).

@param string $string
@return string
Escape Html Attribute