note 74781 deleted from function.http-build-query by hholzgra

Note Submitter: pinkgothic at gmail dot com ---- Be careful if you're assuming that arg_separator defaults to "&". For me, with my xampp installation and PHP 5.2.1, this was scary: [php.ini] ; The separator used in PHP generated URLs to separate arguments. ; Default is "&". arg_separator.output = "&" ... as it gave me a complete headache debugging something, as I expected the string length to be the length of the string my browser was displaying. I was so certain arg_separator was "&" because I'd never changed my php.ini that it took me seemingly forever to consider looking at the source code. D'oh. This may seem irrelevant at first (and I realise my case is an unusual way of stumbling into this issue), but since, if you run htmlspecialchars() over "&", the result will be "&", DON'T expect a one- or two-parameter http_build_query() to return a query you still have to run through htmlspecialchars(). I suggest using the third parameter to retain your sanity.