Users with email address's containing & shows up as HTML &amp breaking certain connectivity

[waynep16]

The email address is set to tes&123@… but WordPress back end-user panel is treating it as tes&amp123@… which is causing malformed results when trying to perform other actions we need.

See screenshot - ​https://i.snipboard.io/VHAgmO.jpg

[dd32]

Took a look at this:

• The screenshot shows this as being a plugin issue, but the underlying issue is Core.
• Stored within the database as & (This seems wrong)
• A Display quirk is that it's not escaped properly, it should display as & if that's what's in the database.
• Network admin user list isn't "affected" - which is an issue, as it means it's not being escaped/run through the same filters as the single-site list.
• Single site is affected by the display quirk, as the user list table sets $user_object->filter = 'display'; which triggers running sanitize_email() over the value, which does not allow for ; within the email and so strips it.

Seems like the fix here is to ensure that the email is being escaped properly in all locations (I think this will just mean the Network Admin) and to adjust the escaping on save to not save it with HMTL entities for future user edits.

The cause for the database containing & is that wp_filter_kses() is hooked to pre_user_email, which seems like the wrong function for that.. sanitize_email() should be enough https://core.trac.wordpress.org/browser/trunk/src/wp-includes/default-filters.php?annotate=blame&marks=46-50&rev=51338#L40 This dates back to [11929].