ucla/mwf — Issue #42: htmlspecialchars() conflicting with URI parameters?
Author: ebollens
Created: 2011-12-15 04:12:46+00:00
State: open

Having problems with the Head_Site_Decorator concatenating multiple parameters with & rather than &.

Here's the old version:

```php
@@ -110,10 +110,10 @@ class Head_Site_Decorator extends Tag_HTML_Decorator
private function _generate_url_param_string($params) {
$rv = '?';
foreach($params as $key=>$val) {
$rv .= is_int($key) ? $val.'&' : $key.'='.$val.'&';
}
$rv = rtrim($rv,'?&');
return htmlspecialchars($rv);return $rv;
}
```

A possible fix would remove the htmlspecialchars() on the query string and instead apply it directly to names and values.

```php
@@ -110,10 +110,10 @@ class Head_Site_Decorator extends Tag_HTML_Decorator
private function _generate_url_param_string($params) {
$rv = '?';
foreach($params as $key=>$val) {
$rv .= is_int($key) ? htmlspecialchars($val).'&' : htmlspecialchars($key).'='.htmlspecialchars($val).'&';
}
return rtrim($rv,'?&');
}
```

Thoughts?