Why are Joomla url query strings commonly delimited with "&" instead of "&"?

Question

I often see Joomla url querystrings with & delimiters between key-value pairs instead of the standard &.

In a previous question, How to make my Editor plugin (type: editors-xtd) survive after updates?, I demonstrated the call of http_build_query() (which I think more Joomla developers should adopt as standard practice to improve code readability and stability) to aid in the declaration of the $button->link value in my onDisplay() method.

Once I got my flawed code working, I realised that the default delimiter (&) worked just as well as its html entity (&) which is commonly used. Granted, I didn't spend any time testing different scenarios to try to break it either.

My question today is: Why do I see & so frequently used in url query strings? Does Joomla even need it anymore? More specifically, what are some known scenarios in which & will fail and & will succeed? Are there any trustworthy references/documents on this topic relating specifically to Joomla?

I did casually ask Sharky about this in chat @ https://chat.stackexchange.com/transcript/message/48851670#48851670:

[...] can you explain why your solution (and several others that I have seen) are using & in $button->link while my original script works fine with just &?

Sharky responded with:

My guess is ampersand is escaped for compatibility with older browsers/templates and HTML validity.

Would anyone like to weigh in on Sharky's assertion?

For the record, no matter which delimiter you choose, http_build_query() can/should be used.

Code: (Demo)

$query_string = [
    'one'   => 1,    
    'two'   => '',
    'three' => null,        // gets omitted
    'four'  => ' ',         // gets encoded
    'five'  => "&test=test" // gets encoded
];

echo http_build_query($query_string);
echo "\n---\n";
echo http_build_query($query_string, '', '&');

Output:

one=1&two=&four=+&five=%26test%3Dtest
---
one=1&two=&four=+&five=%26test%3Dtest

Answer 1

It is to do with with HTML/XHTML compatibility. Before HTML5 having unencoded ampersands in URLs and in some other contexts was invalid. From XHTML validator:

Entity references start with an ampersand (&) and end with a semicolon (;). If you want to use a literal ampersand in your document you must encode it as "&" (even inside URLs!). Be careful to end entity references with a semicolon or your entity reference may get interpreted in connection with the following text.

Common HTML Validation Problems - Ampersands (&'s) in URLs

Ampersands, PHP Sessions and Valid HTML

Answer 2

This is my own experience, in manifest file of a custom component extension for instance, once you are going to assign a menu with submenus for extension in Joomla backend to assign the path to reach assigned view and layout in xml file, '&' does not work, you are supposed to employ ampersand, this way Joomla exercises more security yet as you said '&' works in many parts and replacable with ampersand, in more sensitive parts like this example it is not replacable.