WP_Scripts->_print_scripts and add_query_arg generate invalid links

[Nazgul]

When a link with more than 1 parameter is generated by WP_Scripts, it's generated as ​http://domain.tld/somescript.js?a=1&b=2, which should be ​http://domain.tld/somescript.js?a=1&b=2, according to the XHTML guidelines.

Same applies to the add_query_arg function.

[Nazgul]

Patch which uses & instead of & to concatenate uploaded.

[markjaquith]

& should not be used within add_query_arg() function. Rather, the thing that is calling it should run wp_specialchars() on the output. We need non-encoded to be the default.

The Script Loader fix looks good, though.

[Nazgul]

Ok. New Patch.

Instead of changing add_query_arg I changed the calling function in which I noticed the behaviour (wp_nonce_url), as you suggested.

The Script Loader fix is also included, but hasn't changed.

[markjaquith]

Looks good to me. The only potential concern is if wp_nonce_url is fed to a redirection script. e.g. wp_redirect(wp_nonce_url($url, $action));

Attn: Owen and Ryan, Is this a plausible scenario?

[ryan]

[3930] fixes script-loader.

[ryan]

wp_nonce_url() is being used on URLs that are already converted, so maybe we should go ahead and specialchars within wp_nonce_url().

[ryan]

(In [3973]) wp_specialchars() within wp_nonce_url(). Props Nazgul. fixes #2857

[ryan]

(In [3974]) wp_specialchars() within wp_nonce_url(). Props Nazgul. fixes #2857