#186963 by JirkaRybka: remove HTML from link titles (attribute values) if it...

#186963 by JirkaRybka: remove HTML from link titles (attribute values) if it seems we have tags included

includes/common.inc

@@ -1396,6 +1396,13 @@ function l($text, $path, $options = array()) {
       $options['attributes']['class'] = 'active';
     }
   }
+
+  // Remove all HTML and PHP tags from a tooltip. For best performance, we act only
+  // if a quick strpos() pre-check gave a suspicion (because strip_tags() is expensive).
+  if (isset($options['attributes']['title']) && strpos($options['attributes']['title'], '<') !== FALSE) {
+    $options['attributes']['title'] = strip_tags($options['attributes']['title']);
+  }
+
   return '<a href="'. check_url(url($path, $options)) .'"'. drupal_attributes($options['attributes']) .'>'. ($options['html'] ? $text : check_plain($text)) .'</a>';
 }