blocks|key|3959072|text|绝对没有功能上的区别。这两种方法都是有效的，尽管双引号的使用更广泛，而且更受欢迎。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3959073|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Absolutely no functional difference. Both are valid, although double quotes are more widely used and are preferred.

blocks|key|791631|text|没有功能上的区别。Quoting+the+W3C+on+SGML+and+HMTL|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|791632|791633|默认情况下，SGML要求使用双引号(ASCII十进制34)或单引号(ASCII十进制39)分隔所有属性值。当属性值由双引号分隔时，可以在属性值中包括单引号，反之亦然。|blockquote|791634|791635|..。|791636|在某些情况下，作者可以指定不带任何引号的属性的值。属性值只能包含字母(a-z和A-Z)、数字(0-9)、连字符(ASCII十进制45)、句点(ASCII十进制46)、下划线(ASCII十进制95)和冒号(ASCII十进制58)。我们建议使用引号，即使可以消除引号也是如此。|791637|entityMap|0|LINK|mutability|MUTABLE|url|http://www.w3.org/TR/html4/intro/sgmltut.html#h-3.2.2^0|9|W|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@$A|V|B|W|1|X]]|C|$]]|$1|D|3|-4|5|6|7|Y|8|@]|9|@]|C|$]]|$1|E|3|F|5|G|7|Z|8|@]|9|@]|C|$]]|$1|H|3|-4|5|6|7|10|8|@]|9|@]|C|$]]|$1|I|3|J|5|6|7|11|8|@]|9|@]|C|$]]|$1|K|3|L|5|6|7|12|8|@]|9|@]|C|$]]|$1|M|3|-4|5|6|7|13|8|@]|9|@]|C|$]]]|N|$O|$5|P|Q|R|C|$S|T]]]]

There is no functional difference. <a href="http://www.w3.org/TR/html4/intro/sgmltut.html#h-3.2.2" rel="nofollow noreferrer">Quoting the W3C on SGML and HMTL</a>:
<blockquote>
By default, SGML requires that all attribute values be delimited using either double quotation marks (ASCII decimal 34) or single quotation marks (ASCII decimal 39). Single quote marks can be included within the attribute value when the value is delimited by double quote marks, and vice versa.
...
In certain cases, authors may specify the value of an attribute without any quotation marks. The attribute value may only contain letters (a-z and A-Z), digits (0-9), hyphens (ASCII decimal 45), periods (ASCII decimal 46), underscores (ASCII decimal 95), and colons (ASCII decimal 58). We recommend using quotation marks even when it is possible to eliminate them.
</blockquote>

blocks|key|2550959|text|就html而言，没有什么不同。它们都得到了支持。当你开始通过其他方式动态输出它时，你只需要注意正确地转义，等等。但这只是你正在使用的脚本语言，而不是你的浏览器。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2550960|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

As far as html is concerned there is no difference. They are both supported. It's when you get into dynamically outputting it via other means that you just need to take care to escape properly etc.. but that's as far as whatever scripting language you are using is concerned, not your browser.

blocks|key|1540319|text|从功能的角度来看，这是没有区别的。从安全的角度来看，有以下几种方法。当您使用单引号时，黑客更容易执行XSS+(当然，当这些引号中的文本来自不受信任的来源时)。然而，我不会只赌双引号。您最好对该属性值使用适当的编码。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1540320|​|1540321|1540322|更新：|1540323|1540324|下面是一个使用ASP.NET的示例：|1540325|<input+type='button'+
++++value='<%25+=+HttpUtility.HtmlEncode(Request["button"])+%25>'+/>|code-block|syntax|javascript|1540326|由于使用了单引号，这段代码更容易被黑客利用。下面是一个例子。当您将以下文本放入查询字符串的button参数时，您将获得一个成功的*+XSS漏洞：|offset|length|style|CODE|1540327|click'+onclick='alert("xss")|1540328|如下所示：|1540329|mypage.aspx?button?click'%2520onclick='alert("xss")|1540330|当我们用双引号编写代码片段时，这种攻击不会成功，如下所示：|1540331|<input+type='button'+
++++value="<%25+=+HttpUtility.HtmlEncode(Request["button"])+%25>"+/>|1540332|我希望这能把事情弄清楚一点。|1540333|*当然，最新的浏览器会检测到这种类型的攻击(称为反射XSS)，但不会检测到这种攻击，因为该字符串不是直接来自浏览器(称为持久XSS)。|1540334|entityMap^0|0|0|0|0|0|0|0|19|6|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1A|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1B|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|1C|8|@]|9|@]|A|$]]|$1|E|3|F|5|6|7|1D|8|@]|9|@]|A|$]]|$1|G|3|C|5|6|7|1E|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|1F|8|@]|9|@]|A|$]]|$1|J|3|K|5|L|7|1G|8|@]|9|@]|A|$M|N]]|$1|O|3|P|5|6|7|1H|8|@$Q|1I|R|1J|S|T]]|9|@]|A|$]]|$1|U|3|V|5|L|7|1K|8|@]|9|@]|A|$M|N]]|$1|W|3|X|5|6|7|1L|8|@]|9|@]|A|$]]|$1|Y|3|Z|5|L|7|1M|8|@]|9|@]|A|$M|N]]|$1|10|3|11|5|6|7|1N|8|@]|9|@]|A|$]]|$1|12|3|13|5|L|7|1O|8|@]|9|@]|A|$M|N]]|$1|14|3|15|5|6|7|1P|8|@]|9|@]|A|$]]|$1|16|3|17|5|6|7|1Q|8|@]|9|@]|A|$]]|$1|18|3|-4|5|6|7|1R|8|@]|9|@]|A|$]]]|19|$]]

From a functional perspective there are no differences. From a security perspective there are. It is easier for a hacker to do XSS when you use single quotes (when the text within those quotes comes from an untrusted source, of course). However, I wouldn't bet on only double quotes. You'd better use proper encoding on that attribute value.

<hr/>
Update:

Here is an example with ASP.NET:

<pre><code>&lt;input type='button' 
 value='&lt;% = HttpUtility.HtmlEncode(Request["button"]) %&gt;' /&gt;
</code></pre>

Because of the use of single quotes, this code snippet is easier to exploit for a hacker. Here is an example. When you put the following text in the <code>button</code> argument of the query string, you will have a successful* XSS exploit:

<pre><code>click' onclick='alert("xss")
</code></pre>

as in:

<pre><code>mypage.aspx?button?click'%20onclick='alert("xss")
</code></pre>

This attack wouldn't have been successful when we would have written the snippet with double quotes as follows:

<pre><code>&lt;input type='button' 
 value="&lt;% = HttpUtility.HtmlEncode(Request["button"]) %&gt;" /&gt;
</code></pre>

I hope this clears things up a bit.

*Of course, the newest browsers will detect this type of attack (which is called reflected XSS), but won't detect this, when this string didn't come directly from the browser (which is called persistent XSS).

blocks|key|3959271|text|标准(XHTML)是双引号，但是浏览器仍然支持非标准的HTML页面，所以它们仍然可以理解单引号。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3959272|您不必转义双引号。|3959273|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

The standard (XHTML) is double quotes, but browsers still support the non-standard HTML pages out there so they can still understand the single quotes.

You don't have to escape the double quotes.

blocks|key|1536878|text|对字符串变量使用单引号有时会给出“字符文字中的字符太多”的错误。例如在Entity+Framework中定义一个类：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1536879|public+class+DevEnt()
{
public+string+IMEI+{get;+set;}
public+Datetime+{get;+set;}
}|code-block|syntax|javascript|1536880|则在初始化来自该类的实例的IMEI字段时，|1536881|dev=new+DevEnt(){
Dev_IMEI="111111",
Date=new+DateTime(2015,12,1)
}|1536882|使用像Dev_IMEI='111111'这样的单报价将会出现错误。|offset|length|style|CODE|1536883|entityMap^0|0|0|0|0|3|H|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|U|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|V|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|W|8|@$M|X|N|Y|O|P]]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|R|$]]

Using single Quote for string variables sometimes will give a "too many charactors in charactor literal" error. For example define a class in Entity Framework:

<pre><code>public class DevEnt()
{
public string IMEI {get; set;}
public Datetime {get; set;}
}
</code></pre>

Then when initializing the IMEI field of an instance from this class, 

<pre><code>dev=new DevEnt(){
Dev_IMEI="111111",
Date=new DateTime(2015,12,1)
}
</code></pre>

using single Quote like <code>Dev_IMEI='111111'</code> will give an error.

Let <code>sEncodedHref</code> represent an <code>HttpUtility.HtmlAttributeEncode(..)</code>'d string.

Are there any functional differences between generated html like this:

<pre><code>String.Format(@"&lt;span class='blue' src='{0}'&gt;", sEncodedHref);
</code></pre>

vs. generated html like this:

<pre><code>String.Format(@"&lt;span class=""blue"" src=""{0}""&gt;", sEncodedHref);
</code></pre>

I've been under the impression that the single-quoted variant is both less supported and less "safe", however I have trouble providing reasons to support that argument.

What are the functional differences between single-quoted vs double-quoted html attributes?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

让sEncodedHref表示一个HttpUtility.HtmlAttributeEncode(..)'d字符串。生成的html之间是否有任何功能上的差异：String.Format(@"", sEncodedHref);与生成的html如下所示：String...

问单引号和双引号的html属性在功能上有什么不同？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问单引号和双引号的html属性在功能上有什么不同？EN