Commas in autocomplete textfield give incorrect behaviour

Proposed solution (although not amazing!)

Replace three occurrences of comma to backtick instead. Not sure if this is wise from a security perspective. A better solution would be to implement a rarer / safe character, or have a multi-character marker that is extremely unlikely for someone to type, although this changes the code if the separator isn't a single character.

In file /core/misc/autocomplete.js

In these two sections of code, I've replaced a comma character with a backtick character:

Single replacement of comma to backtick:

  /**
   * Helper splitting terms from the autocomplete value.
   *
   * @function Drupal.autocomplete.splitValues
   *
   * @param {string} value
   *   The value being entered by the user.
   *
   * @return {Array}
   *   Array of values, split by comma.
   */
  function autocompleteSplitValues(value) {
    // We will match the value against comma-separated terms.
    var result = [];
    var quote = false;
    var current = '';
    var valueLength = value.length;
    var character;

    for (var i = 0; i < valueLength; i++) {
      character = value.charAt(i);
      if (character === '"') {
        current += character;
        quote = !quote;
      }
      else if (character === '`' && !quote) {
        result.push(current.trim());
        current = '';
      }
      else {
        current += character;
      }
    }
    if (value.length > 0) {
      result.push($.trim(current));
    }

    return result;
  }

Two replacements of comma to backtick:

  /**
   * Handles an autocompleteselect event.
   *
   * @param {jQuery.Event} event
   *   The event triggered.
   * @param {object} ui
   *   The jQuery UI settings object.
   *
   * @return {bool}
   *   Returns false to indicate the event status.
   */
  function selectHandler(event, ui) {
    var terms = autocomplete.splitValues(event.target.value);
    // Remove the current input.
    terms.pop();
    // Add the selected item.
    if (ui.item.value.search('`') > 0) {
      terms.push('"' + ui.item.value + '"');
    }
    else {
      terms.push(ui.item.value);
    }
    event.target.value = terms.join('` ');
    // Return false to tell jQuery UI that we've filled in the value already.
    return false;
  }

OK, so not enough testing at all! Apologies. The comma is now allowed, but "hello`goodbye`apple" will still match possible autocomplete suggestions with the word "apple".