title: Is addslashes() safe to prevent XSS in a HTML attribute?
body: <p>I'm having to work on an old web app that a previous developer left. It is using addslashes() to prevent XSS on a HTTML attribute.</p>
  
  <p>Here is an example:</p>
  
  <pre><code>&lt;?php
    // all $_POST vars are put through addslashes()
  
    echo "&lt;input type='hidden' value='" . $_POST['id'] . "' /&gt;";
  ?&gt;
  </code></pre>
  
  <p>Is this vulnerable to XSS? Is there any way javascript can run in a value attribute like it can in an src attribute for example, src='javascript:alert(99)'. Or can the value attribute be broken out of and then script tags can be inserted?</p>
  
  <p>Edit: Thanks to Quentin, I believe it is vulnerable.</p>