1. create new content > page
2. as title put One & Two & Three
3. as body put One & Two & Three
4. Preview (filter = Filtered HTML)
5. The title shows One & Two & Three(correct) The body shows One & Two & Three(incorrect).

Apparently everything is saved correctly in the database but the & is translated to &amp; on display time and the &amp; is not touched. So what if I want to have &amp; in my text without surrouding it with < code >? Should I write &amp;amp;? Moreover it's different for title & body fields...

Is this by design? Quite strange though.

Comments

jax’s picture

jax commented
Title: Ambiguous translation of entities » Ambiguous encoding of entities

More correct title.

jax’s picture

jax commented

Apparently there are more encoding problems with forms. If you submit a comment (like this one) and you put a < in it, the comment get's truncated. In the source you can see the complete comment.

(submitting this comment twice, once with < and once with &lt; after "put a")

jax’s picture

jax commented

Apparently there are more encoding problems with forms. If you submit a comment (like this one) and you put a < in it, the comment get's truncated. In the source you can see the complete comment.

(submitting this comment twice, once with < and once with &lt; after "put a")

heine’s picture

heine commented
Status: Active » Closed (works as designed)

This is by design: node / comment titles are 'plain text' whereas node / comment bodies may contain HTML. The exact transformation is defined by the selected 'Input format'.

If you add a raw < to your comment body it is send to the browser and interpreted as the start of a tag. Use &lt; or <code> tags.

jax’s picture

jax commented
Status: Closed (works as designed) » Active

Well, that's bad design then. If you submit data that breaks your page there should be an error, it shouldn't just accept it. So I'm reopening this once with the suggestion to patch the filter so that it doesn't accept such input. It would be much more user-friendly.

Image someone that doesn't know about entities and he tries to submit a preview. Could luck for him figuring out that he shouldn't write < but &lt;. Moreover there is absolutely no hint in the text that tells the submitter the form will behave like that.

Steven’s picture

Steven commented
Status: Active » Closed (works as designed)

If your users cannot use HTML, you should change the HTML filter's settings to escape all HTML tags. In that case, any literal < or > characters will be automatically escaped.