Problem with escaped characters in attributes The default theme_image() is implemented as

function theme_image($variables) {
  $attributes = $variables['attributes'];
  $attributes['src'] = file_create_url($variables['path']);

  foreach (array('width', 'height', 'alt', 'title') as $key) {

    if (isset($variables[$key])) {
      $attributes[$key] = $variables[$key];
    }
  }

  return '&lt;img' . drupal_attributes($attributes) . ' /&gt;';
}


drupal_attributes() is implemented as

function drupal_attributes(array $attributes = array()) {
  foreach ($attributes as $attribute =&gt; &amp;$data) {
    $data = implode(' ', (array) $data);
    $data = $attribute . '="' . check_plain($data) . '"';
  }
  return $attributes ? ' ' . implode(' ', $attributes) : '';
}


and check_plain() as

function check_plain($text) {
  return htmlspecialchars($text, ENT_QUOTES, 'UTF-8');
}


Since htmlspecialchars() is being called with ENT_QUOTES, single quotes in my title and alt text on the image are being escaped as &amp;#039; and double quotes as &amp;#quot;, so hovers look weird.

Is there an acceptable, safe, secure way to handle this situation?
Make sure you aren't check_plain()ing the value before calling it, eg, don't do:

... theme('image', array('path' =&gt; 'test.jpg', 'alt' =&gt; check_plain($foo));


or otherwise use a $value that has been processed by any 'safe' filters.