How-to XHTML 1.1 validate an ampersand without escaping it?

Question

My issue is the following. I have a XHTML 1.1 page that has a form and input fields. One of the input fields contains a value which is an URI. This URI contains key-value pairs with ampersand (&) as argument separator, that will be passed as a GET request by another web application in the browser.

Usually I would use the entity & to create the ampersands to validate the code as XHTML 1.1. My problem here is that the application does not receive the GET request, since (as expected) the browser does not understand how to handle & in the URI.

So my question is really how to write an ampersand without using the HTML entity, so the browser still recognises it as the argument separator and the GET request is passed on properly to the web app.

I tried Hex (%26) encoding the ampersand but the browser still does not "translate" it back to a proper & character.

A related question, but it does not provide the exact answer to the question I am asking:

http://stackoverflow.com/questions/275150/xhtml-and-ampersand-encoding

Answer 1

There is no way to include an ampersand character in an attribute value without using an entity.

There is no way to include an ampersand character as a textNode without using an entity or CDATA markers (but I bet you are serving as text/html so you can't use those).

That said — any browser which fails to decode the entity is broken. No mainstream browser fails there. You are either using an obscure and broken browser, or are misdiagnosing the problem.

Answer 2

Without the code its difficult to tell where you are trying to keep this information, if you could post the code we could do a better job understanding the problem.

One possible (if this is in fact what you are facing) is to move the items in the querystring into other form elements, such as:

<form action="example.com/?foo=1&bar=2>
    <!-- ... -->
</form>

to:

<form action="example.com">
    <input type="hidden" name="foo" value="1" />
    <input type="hidden" name="bar" value="2" />
    <!-- ... -->
</form>

Answer 3

As mentioned in the other question you referenced, the browser converts the & to & when the page is processed, so the "&" (not &) should be sent to the server in the GET request. Perhaps you are using Ajax to make the GET request, in which case, you may need to decode the HTML. The entity is required for XHTML--no alternative encoding, just make sure it is properly decoded.

Reference: The & changes to & in a hyperlink

Answer 4

I could not bother spending more time on this. I simply changed the argument separator to also include semi-colon (;) so I can use it instead of ampersand:

#cat .htaccess
php_value arg_separator.input "&;"

Answer 5

the escaped & should be converted by the client (browser) everywhere in the XHTML document. so you should escape every & with &