Actually, Sanitizer::encodeAttribute() was broken, so my last fix didn't actually...

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index f2dcbf9..c1c8daf 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -725,7 +725,7 @@ class Sanitizer {
         * @return HTML-encoded text fragment
         */
        static function encodeAttribute( $text ) {
-               $encValue = htmlspecialchars( $text );
+               $encValue = htmlspecialchars( $text, ENT_QUOTES );
 
                // Whitespace is normalized during attribute decoding,
                // so if we've been passed non-spaces we must encode them