Index: includes/common.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/common.inc,v
retrieving revision 1.1093
diff -u -p -r1.1093 common.inc
--- includes/common.inc	27 Jan 2010 11:41:20 -0000	1.1093
+++ includes/common.inc	29 Jan 2010 14:22:54 -0000
@@ -2757,7 +2757,11 @@ function l($text, $path, array $options 
   if ($use_theme) {
     return theme('link', array('text' => $text, 'path' => $path, 'options' => $options));
   }
-  return '<a href="' . check_plain(url($path, $options)) . '"' . drupal_attributes($options['attributes']) . '>' . ($options['html'] ? $text : check_plain($text)) . '</a>';
+
+  // When $options['query'] is passed, run the output of url() through
+  // check_plain() to ensure the query string is properly encoded.
+  $url = isset($options['query']) ? check_plain(url($path, $options)) : url($path, $options);
+  return '<a href="' . $url . '"' . drupal_attributes($options['attributes']) . '>' . ($options['html'] ? $text : check_plain($text)) . '</a>';
 }
 
 /**