Why is “®” being rendered as “®” without the bounding semicolon

Question

I\'ve been running into a problem that was revealed through our Google adwords-driven marketing campaign. One of the standard parameters used is \"region\". When a user se

Answer 1

Maybe try replacing your & as &? Ampersands are characters that must be escaped in HTML as well, because they are reserved to be used as parts of entities.

Answer 2

To prevent this from happening you should encode urls, which replaces characters like the ampersand with a % and a hexadecimal number behind it in the url.

Answer 3

It seems to me that what you have received from google is not an actual URL but a variable which refers to a url (query-string). So, thats why it's being parsed as registration mark when rendered.

I would say, you owe to url-encode it and decode it whenever processing it. Like any other variable containing special entities.

Answer 4

Escape your output!

Simply enough, you need to encode the url format into html format for accurate representation (ideally you would do so with a template engine variable escaping function, but barring that, with htmlspecialchars($url) or htmlentities($url) in php).

See your test case and then the correctly encoded html at this jsfiddle: http://jsfiddle.net/tchalvakspam/Fp3W6/

Inactive code here:

<div>
Unescaped:
<br>
<a href="">http://foo.com/bar?foo=bar&region=US&register=lowpass&reg_test=fail&trademark=correct</a>
</div>

<div>
Correctly escaped:
<br>
http://foo.com/bar?foo=bar&amp;region=US&amp;register=lowpass&amp;reg_test=fail&amp;trademark=correct
</div>

Answer 5

1: The following markup is invalid in the first place (use the W3C Markup Validation Service to verify):

<a href="http://foo.com/bar?foo=bar&region=US&register=lowpass&reg_test=fail&trademark=correct"></a>

In the above example, the & character should be encoded as &, like so:

<a href="http://foo.com/bar?foo=bar&amp;region=US&amp;register=lowpass&amp;reg_test=fail&amp;trademark=correct"></a>

2: Browsers are tolerant; they try to make sense out of broken HTML. In your case, all possibly valid HTML entities are converted to HTML entities.

Answer 6

Here is a simple solution and it may not work in all instances.

So from this:

http://ravercats.com/meow?status=Online&region=Atlantis

To This:

http://ravercats.com/meow?region=Atlantis&status=Online

Because the &reg as we know triggers the special character ®

Caveat: If you have no control over the order of your URL query string parameters then you'll have to change your variable name to something else.