If the user sets the URL ahah_helper_demo to have an alias of, say, <ah"ah> <hel"per> <de"mo>, then there will be invalid HTML on the page when the ahah_helper_demo module is enabled.

CommentFileSizeAuthor
#1 ahah_helper-1243182-d6.patch1.01 KBohnobinki

Comments

ohnobinki’s picture

ohnobinki commented
Status: Active » Needs review
StatusFileSize
new ahah_helper-1243182-d6.patch1.01 KB

Nevermind, my example doesn't work because urlencode() gets most every invalid XHTML character. But in general, the output of url() should be handled with t()'s `@' instead of `!', which accounts for the potential future of the URL including a query string which is entirely possible to do with clean URLs turned off and modules hooking into URL generation code, perhaps with http://drupal.org/project/url_alter 's help.