URLs should be escaped
Closed this issue · 1 comments
fregante commented
URLs may contain HTML-looking parts, such as &, which browsers friendly turn to & in code.
Live example: https://runkit.com/embed/jxchw34aqffr (RunKit nicely shows the rendered HTML as well)
The value should always be escaped; the href attribute doesn't seem to be as smart with entities (& is converted to & but & isn't) so probably it doesn't need to be escaped.
fregante commented
Perhaps this can be handled by create-html-element: sindresorhus/create-html-element#2