If the delimiter here is '&' then it needs to be escaped for inclusion
in an attribute. Use html_attrf() to ensure that this happens (we know
that hex won't need escaping, but this makes it clearer what's
happening.
Signed-off-by: John Keeping <john@keeping.me.uk>
html_attr(pageurl);
if (ctx.cfg.virtual_root)
delim = '?';
html_attr(pageurl);
if (ctx.cfg.virtual_root)
delim = '?';
- htmlf("%cid=%s", delim, hex);
+ html_attrf("%cid=%s", delim, hex);
html("'/>\n");
free(pageurl);
}
html("'/>\n");
free(pageurl);
}