src url encoding - ampersands should not be encoded in img and iframe src

[franzo]

This happens for both img and iframe tags.

Steps to reproduce:

1. Click Source

2. Paste in img or iframe code like this:

   <iframe src="https://foo.bar?test1=1&test2=2">...</iframe>
   <img src="https://foo.bar?test1=1&test2=2" />
   

3. Click Source again

4. Click Source again, and now you will see:

   <iframe src="https://foo.bar?test1=1&amp;test2=2">...</iframe>
   <img src="https://foo.bar?test1=1&amp;test2=2" />
   

See that the ampersands have been encoded, which breaks the urls.

Reproduced in 3.6.4 and 4.0 beta using Chrome and Firefox.

[Jakub Ś]

Ampersand character is a special case which must always be encoded.

You may disable this encoding with below configuration option ​http://docs.cksource.com/ckeditor_api/symbols/CKEDITOR.config.html#.forceSimpleAmpersand but you should not do it as & does not break URL.

If you enter working link and CKEditor will change & to & turn on the preview mode and click on a link. It will work.

Please also refer to ​http://www.w3.org/TR/xhtml1/#C_12.

[Jakub Ś]

#13905 was marked as duplicate.