Proper encoding of href for window.open() in JavaScript

Question

What is the proper cross-browser encoding for the href when using window.open() in JavaScript? First I was using

var href = "http://127.0.0.1:8000/etf/admin/escola/t34atividade/?pop=1&copy=1";
var win = window.open(href, name, 'height=500,width=800,resizable=yes,scrollbars=yes');

IE8 opens: http://127.0.0.1:8000/etf/admin/escola/t34atividade/?pop=1©=1

FireFox opens: http://127.0.0.1:8000/etf/admin/escola/t34atividade/?pop=1&copy=1

var href = "http://127.0.0.1:8000/etf/admin/escola/t34atividade/?pop=1&copy=1";
var win = window.open(href, name, 'height=500,width=800,resizable=yes,scrollbars=yes');

IE8 opens: http://127.0.0.1:8000/etf/admin/escola/t34atividade/?pop=1&copy=1

FireFox opens: http://127.0.0.1:8000/etf/admin/escola/t34atividade/?pop=1&copy=1

Answer 1

Use the Javascript "encodeURIComponent" function for each piece of the URI that's not part of the URI syntax (that is, separator slashes, the question mark for the query string, parameter separator ampersands, etc).

URI encoding is not the same as HTML escaping. For example, you don't escape an ampersand in a URL as &.

Answer 2

The simplest solution I found was to stop using copy as a GET parameter. The problem is that &copy is actually an HTML entity for the copyright symbol. IE applies an entity replacement converting it to the symbol even though it's in JavaScript code. Apparently Firefox does not perform the entity replacement. According to a comment in this blog what IE is doing might be correct, but to avoid all the mess I just renamed my parameter to clone.

http://nedbatchelder.com/blog/200812/accidental_html_entities_in_urls.html