Browser mis-interpreting '&not' in URL

Question

Apparently if a URL containing the text &not is used as part of a field property, many browsers will interpret this as '¬'. So this HTML code:

<a href="#" onclick="window.location='http://www.example.com?some_param=1&notify=true';">Click here</a>

will be rendered as:

<a href="#" onclick="window.location='http://www.example.com?some_param=1¬ify=true';">Click here</a>

I found a couple of alternatives by substituting &not with &%6Eot, or by POSTing a form instead of GETting a parameterized URL. But POSTs aren't always a welcome alternative and substitution is admittedly a hack - it will also need to deal with other common tokens as &cent, &curren, &pound, &sect, &copy, &reg... (list taken from here).

Surely someone out there has a better solution for this?

Answer 1

Element attributes are interpreted by the HTML parser, so you must escape & characters as &. It works most of the time even if you don't, but in some cases (such as yours) you have to do it "right" or it won't work.