I have a Wordpress tooltip plugin that converts any links in the tooltip text using special entities, so that my
Is there any difference in terms of security in this? Do browsers correctly interpret the
rel="noopener" tag? To clarify, I'm referring to a new page opened with
target="_blank" being able to access my
I should mention that
<a href=" is also converted to
<a href=" but functionality isn't lost (i.e. the link is generated normally).
Going into the plugin's innards, I noticed it generates the text using this line:
$html .= '<span class="tooltips '.$special_class.'" style="'.$style.'" title="'.htmlspecialchars(do_shortcode($content)).'">'.do_shortcode($trigger).'</span>';
Which means, HTML is generated using PHP's
htmlspecialchars. According to the manual:
Certain characters have special significance in HTML, and should be represented by HTML entities if they are to preserve their meanings.
This is an example of the actual HTML output as shown on "View Source":
<p>You are basically "seeing things". That's one reason I am referring to it as a <span class="tooltips " style="" title="For more on this, see this post on the <a href="https://plato.stanford.edu/entries/depiction/" rel="noopener" target="_blank">philosophy of depiction</a>."><span class="tooltext">philosophy of seeing</span> </span>.</p>
The actual output on the browser (hovering on the tooltip) looks like this. The link works and opens in a new tab.
I also looked at these two questions, but they don't seem to be directly relevant to my question: