URLs should be escaped
Closed this issue · 1 comments
fregante commented
URLs may contain HTML-looking parts, such as &
, which browsers friendly turn to &
in code.
Live example: https://runkit.com/embed/jxchw34aqffr (RunKit nicely shows the rendered HTML as well)
The value should always be escaped; the href
attribute doesn't seem to be as smart with entities (&
is converted to &
but &
isn't) so probably it doesn't need to be escaped.
fregante commented
Perhaps this can be handled by create-html-element
: sindresorhus/create-html-element#2