#37835 [NEW]: URL rewriting uses raw value of arg_separator.output, not HTML-escaped value

From: ma499 at doc dot ic dot ac dot uk Operating system: n/a PHP version: 5.1.4 PHP Bug Type: Session related Bug description: URL rewriting uses raw value of arg_separator.output, not HTML-escaped value Description: ------------ Was previously submitted here and deemed to be bogus: http://bugs.php.net/bug.php?id=30049 But I think reviwer of original report (nlopess@php.net) misunderstood. This issue is not bogus. As reviewer stated, PHPSESSID is appended later, so is not translated to &. Hence, in order to produce valid HTML/ XHTML output arg_seperator.output must be set to & and is standard practice Up until PHP5 this has not been a problem as nothing else uses arg_seperator.output. BUT such a configuration now causes a problem with the new http_build_query() in PHP5. The output of that function will no longer be valid should the developer want to use in, for example, a Location: header (where the & should not be escaped). This is therefore a bug. I would suggest the problem is with the transid code which shoudl escape it's &PHPSESSID output to &PHPSESSID. Reproduce code: --------------- See http://bugs.php.net/bug.php?id=30049 Expected result: ---------------- See http://bugs.php.net/bug.php?id=30049 Actual result: -------------- See http://bugs.php.net/bug.php?id=30049 -- Edit bug report at http://bugs.php.net/?id=37835&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=37835&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=37835&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=37835&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=37835&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=37835&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=37835&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=37835&r=needscript Try newer version: http://bugs.php.net/fix.php?id=37835&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=37835&r=support Expected behavior: http://bugs.php.net/fix.php?id=37835&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=37835&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=37835&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=37835&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=37835&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=37835&r=dst IIS Stability: http://bugs.php.net/fix.php?id=37835&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=37835&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=37835&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=37835&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=37835&r=mysqlcfg