#25248 [Opn->Bgs]: SESSION encoding in urls should use HTML entities not ampersands

ID: 25248 Updated by: derick@php.net Reported By: js at nomensa dot com -Status: Open +Status: Bogus Bug Type: Output Control Operating System: all PHP Version: 4.3.2 New Comment: Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php See the php.ini setting arg_separator.output Previous Comments: ------------------------------------------------------------------------ [2003-08-26 06:06:13] js at nomensa dot com Description: ------------ When cookies are disabled php encodes a session id in the output urls. It currently uses single ampersands '&' but this is illegal in XHTML (and slightly illegal in HTML), the ampersand character in <a> links etc should be encoded as the entity '&amp;'. Additionally semi-colons could also be used to get around this whole mess. Actually, I prefer semi-colons. It would be good if PHP supported this. Reproduce code: --------------- Go to this link with cookies off: http://alastc.homeip.net/alastairc/page.php Expected result: ---------------- Url should be encoded properly: Should be written as: <li><a href="page.php?domain=&amp;type=news&amp;PHPSESSID=ef38d5d3bc286f6e1de5581003d710d5">News</a></li> Actual result: -------------- Links are written illegally: <li><a href="page.php?domain=&amp;type=news&PHPSESSID=ef38d5d3bc286f6e1de5581003d710d5">News</a></li> This fails the DTD check under XHTML 1.0 (strict) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=25248&edit=1