I often see Joomla url querystrings with & delimiters between key-value pairs instead of the standard &.

In a previous question, How to make my Editor plugin (type: editors-xtd) survive after updates?, I demonstrated the call of http_build_query() (which I think more Joomla developers should adopt as standard practice to improve code readability and stability) to aid in the declaration of the $button->link value in my onDisplay() method.

Once I got my flawed code working, I realised that the default delimiter (&) worked just as well as its html entity (&) which is commonly used. Granted, I didn't spend any time testing different scenarios to try to break it either.

My question today is: Why do I see & so frequently used in url query strings? Does Joomla even need it anymore? More specifically, what are some known scenarios in which & will fail and & will succeed? Are there any trustworthy references/documents on this topic relating specifically to Joomla?

I did casually ask Sharky about this in chat @ https://chat.stackexchange.com/transcript/message/48851670#48851670:

[...] can you explain why your solution (and several others that I have seen) are using & in $button->link while my original script works fine with just &?

Sharky responded with:

My guess is ampersand is escaped for compatibility with older browsers/templates and HTML validity.

Would anyone like to weigh in on Sharky's assertion?

For the record, no matter which delimiter you choose, http_build_query() can/should be used.

Code: (Demo)

$query_string = [
    'one'   => 1,    
    'two'   => '',
    'three' => null,        // gets omitted
    'four'  => ' ',         // gets encoded
    'five'  => "&test=test" // gets encoded

echo http_build_query($query_string);
echo "\n---\n";
echo http_build_query($query_string, '', '&');


  • 1
    Good question. I’ve never understood/see the relevance of using & in request queries in Joomla either. – Zollie Jan 13 '20 at 14:03
  • 1
    I couldn't give you a lot of details now but years ago on PHP based Forums like BB2 and SMF I would occasionally see issues with Apache mod_security causing 403 errors due to a url string with &'s in the wrong place. I am thinking that maybe there is/was some security implications for using & – Irata Jan 13 '20 at 23:22

It is to do with with HTML/XHTML compatibility. Before HTML5 having unencoded ampersands in URLs and in some other contexts was invalid. From XHTML validator:

Entity references start with an ampersand (&) and end with a semicolon (;). If you want to use a literal ampersand in your document you must encode it as "&" (even inside URLs!). Be careful to end entity references with a semicolon or your entity reference may get interpreted in connection with the following text.

Common HTML Validation Problems - Ampersands (&'s) in URLs

Ampersands, PHP Sessions and Valid HTML

  • At least we see it now. Good references! – Zollie Jan 14 '20 at 12:52

This is my own experience, in manifest file of a custom component extension for instance, once you are going to assign a menu with submenus for extension in Joomla backend to assign the path to reach assigned view and layout in xml file, '&' does not work, you are supposed to employ ampersand, this way Joomla exercises more security yet as you said '&' works in many parts and replacable with ampersand, in more sensitive parts like this example it is not replacable.

  • Can you cite any online sources to support your claim that using the html entity improves security somehow? – mickmackusa Jan 14 '20 at 9:36
  • I answered your question in the related thread. – Kian William Nowrouzian Jan 14 '20 at 15:32
  • Please type all of your answer to my question into your answer body on this page. Edit <- here is how you do it. – mickmackusa Jan 14 '20 at 23:07
  • Read my comment in related thread please. – Kian William Nowrouzian Jan 16 '20 at 5:14
  • Well, the idea is that you educate me AND future researchers, so if you feel it improves the overall value of your answer, you should edit it into your answer. That said, I read your now-deleted answer in the other thread and at no point did I see anything that supported the claim that it improves security. – mickmackusa Jan 16 '20 at 5:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.