check_plain gets called after inserting '   ' into the output, so the & gets escaped, and   shows up in the output.

CommentFileSizeAuthor
#1 smiley-nbsp-103416.patch.txt652 bytesWesley Tanaka

Comments

Wesley Tanaka’s picture

Wesley Tanaka commented
Status: Active » Needs review
StatusFileSize
new smiley-nbsp-103416.patch.txt652 bytes
Wesley Tanaka’s picture

Wesley Tanaka commented

Alternatively, if the   is really necessary, every element after the explode() call will have to be check_plain()'ed separately before they are implode()d

Gurpartap Singh’s picture

Gurpartap Singh commented
Status: Needs review » Fixed

Thanks!

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)