views:

56

answers:

1

Put this in your location bar in IE

javascript:location.href='http://www.google.com/search?q=something&lt=bar'

Watch in horror as it helpfully thinks &lt actually means &lt; and makes it a <.

WTF is going on here?

Other browsers don't do this. How do I prevent IE from doing this?

+1  A: 

Since this is part of an HTML document you should escape the & by replacing it by &amp;

An ampersand '&' in HTML mark the start of a character reference entity such as &lt; &gt; and &eacute;

Literal ampersands in your document should be written as &amp;

Note that if that code is generated dynamical you should also escape the URL so that it can appear in a javascript string as well.

Edited: I can confirm this particular problem occurs when pasting javascript code directly in the address bar. It seems HTML character escaping rules are irrelevant here after all.

I've googled a bit and found this blog post which identify that particular behavior as an ie bug.

Alexandre Jasmin
This occurs even when you run javascript in the location bar.It would even occur when referring the function from a .js file.And doing this would break every other browser which doesn't expect javascript strings to be encoded. (It breaks chrome and firefox for sure - not sure about Opera)
HS
@HS Your're right. I found this blog post about the issue it looks like an ie bug http://nedbatchelder.com/blog/200812/accidental_html_entities_in_urls.html
Alexandre Jasmin
Nice find. I tried googling but didn't know what keywords to use. Re-arranging the query string would solve this problem. Thanks. I'm going to mark this answer as 'correct' - edit your post to add this link to it.
HS