If you construct a URL (using the l() function) with query string parameters intended for use with the %get[] token, webform does not appear to take HTML entities into consideration.

Imagine you want to pass Sagger Maker's Bottom Knocker as a query string parameter, you would end up with something like this:

http://example.com/webform-test?test=Sagger%20Maker%26%23039%3Bs%20Bottom%20Knocker

Now, using %get[test] in a webform default value field ends up with this:

Sagger Maker's Bottom Knocker

As you can see, the HTML entity for the apostrophe has not been decoded.

Comments

BladeRider’s picture

Status: Active » Closed (won't fix)

Ooops. Marking as won't fix as the reason for the problem was the offending text being passed through check_plain() - in effect double-escaping!