Home/ Questions/Q 652547
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T22:17:04+00:00

is there any danger if the rails html_escape function would stop escaping ‘&’? I

  • 0

is there any danger if the rails html_escape function would stop escaping ‘&’? I tested a few cases and it doesn’t seem to create any problems. Can you give me a contrary an example? Thanks.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If you put an unescaped “&” into an HTML attribute, it would make your page invalid. For example:

    <a href="http://yoursite.com/?Product=1949&View=1">Link</a>

    The page is now invalid as the & indicates an entity. This is true for any usage of an & on a page (for example, view source and hopefully you’ll notice that Stack Overflow escapes the & signs in this post!)

    The following would make the above example valid:

    <a href="http://yoursite.com/?Product=1949&amp;View=1">Link</a>

    Additional Note

    & characters do need to be escaped in URLs if you want to validate your markup against the W3C validator. Example:

    Line 9, Column 38: & did not start a character reference. 
(& probably should have been escaped as &amp;.)

    <a href="/Example.html?id=987&type=5">Example</a>
    • 0