Dashboard: unescaped & which should be written as &

[hakre]

Titels of aggregated RSS Feeds are not properly output to the Browser. If they containt the "&" Char for example, it is not written as "&".

Tidy Reports: "unescaped & which should be written as &"

I was not able to reproduce with 2.6 bleeding2, when using the same feed, the <span class="post"> elements to not contain the text. only the <cite> tags are left.

Looks like a bad made fix.

More Infos:

Cause:

The ampersand ("&") is a special character in HTML. It marks the beginning of a entity, like "&nbsp" for a non-breaking space.

In XHTML, a entity must also end with a semicolon (";"). For example "&nbsp;"

Because this is so, any time a literal ampersand appears in a document, it needs to be written as a character entity, "&amp;". Ampersands commonly appear in the query string of a URL, and need to be expressed as an entity there.
Example - Normal Ampersand:
Good Smith & son
Good Smith &amp; son
Example - Ampersand in a Query String:
Good <a href="​http://www.domain.com/cgi?x=1&y=2">query string</a>
Good <a href="​http://www.domain.com/cgi?x=1&amp;y=2">query string</a>
Solution:

Please replace "&" with "&amp;".
References:

• W3C entities: ​http://www.w3.org/TR/html4/sgml/entities.html
• WDG : ​http://www.htmlhelp.com/reference/html40/entities/
• Very interesting : ​http://ppewww.ph.gla.ac.uk/~flavell/www/formgetbyurl.html

[Nicholas91]

I've edited dashboard.php (replaced the "&" in URLs with &amp;). My uploaded dashboard.php has the ellipses character, but you should commit this ticket first: #8714.

[Nicholas91]

with correct &amp characters

[Nicholas91]

I've also edited rewrite.php in wp-includes. & is now &amp; .

[DD32]

I'm not sure those in rewrite should be &amp; they're only used internally, not in external documents..

[Nicholas91]

Replying to DD32:

I'm not sure those in rewrite should be &amp; they're only used internally, not in external documents..

It doesn't matter if it's used internally or externally. &amp; is correct, because &feed, &cpage, &withcomments are not entities, so we use &amp; instead.

[DD32]

It doesn't matter if it's used internally or externally. &amp; is correct, because &feed, &cpage, &withcomments are not entities, so we use &amp; instead.

It does, Because URL's do not have entities within them(Only URL encoded entities within fields). Entities are what we use to escape the URL when used within a HTML/XHTML document source.

[Nicholas91]

Ok, you know better than me. Anyway, the dashboard.php file has external links (to google blog search for ex) so it should be commited.

[hakre]

An URI is not XHTML: There is no need for permalinks having &amp; inside. That is a question of definition and since permalinks parse what the webserver passes to the script, they should be decoded (&) and not encoded (&amp;). because at that point, they are in there plain with style. rewrite.diff is invalid.

the other patch - dashboard.diff - is quite this and that. for example URIs passed to clean_url() do not need the &amp; encoding according to a dev (sorry, just wrote a comment there but can not dig it up so no link). I will take a look in dashboard.php and check if there are places to fix.

[hakre]

see also

#9432 #9402 #7131

[hakre]

I had several problems in validating the dashboard. I do not see &amp; problems right now. (okay there is one: line 457 column 77 - Fehler: there is no attribute "autocomplete"). But that is not the case here. So therefore, I change that to invalid because it is not a Bug any longer.

[hakre]

This ticket needs a review.

[hakre]

My fault. Closed so far.