#4026 (ok 4.0.6) IIS 7.5 token mismatch changing server variables

[Isaac Bennetch]

As reported by an anonymous IRC user:

I 'm running latest 4.0.4.1 with IIS 7.5 / PHP 5.2.17 / Firefox 22 and wanted to change a server variable, but every time I clicked on one I got a token mismatch. Turns out, line 128 of server_variables.php does:

$url = htmlspecialchars('server_variables.php?' . PMA_generate_common_url());

The html special chars converts an & (literal ampersand) to & (the character entity) where it shouldn't. This effectively makes it impossible to change any server variables via phpMyAdmin. Changing it to:

$url = ('server_variables.php?' . PMA_generate_common_url());

(kill the htmlspecialchars()) works. But I'm not certain this would be the correct fix.

---

On phpmyadmin-devel, Marc points out:

To be valid XHTML, we have to use & instead of & as the separator.

So far we've tested Firefox 22 with a Linux server and have no problems.

[Michal Čihař]

The htmlspecialchars should not be needed, PMA_generate_common_url already does all the escaping.