Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

When I write HTML tags, I tend to put things in single-quotes, i.e. class='foo'. When I go to make a link on here, <a href=''>foo</a> doesn't work, but <a href="">foo</a> does. Since both are valid, could both be accepted?

Using single-quotes:'>foo

Using double-quotes: foo

share|improve this question
[link text](http-address) ? – yo' Mar 1 '13 at 17:56
I'm not saying there aren't other ways to make links, I'm asking if an existing one can be expanded – DiMono Mar 1 '13 at 18:03
I'm not saying it is a bad idea. However, considering how easy it is to put a link into anywhere on SE (posts, comments, chat), it has a low impact/prize ratio. – yo' Mar 1 '13 at 18:10
up vote 4 down vote accepted

Any changes to the HTML sanitizer's whitelist, with all the security considerations that entails, need a very good reason, and given that there are tons of different ways to create links (with hand-crafted HTML being the lest common one anyway, for good reasons), I don't see adding yet another (even less common) way to be a very good reason.

share|improve this answer

According to the FAQ on allowed HTML, double quotes are required:

You must enter the tags exactly as shown. Any deviation from this list—adding extra spaces, using single quote or no quotes, etc.—means the tag will be stripped.

However, that's not quite how HTML hyperlinks are supposed to be stripped when they are invalid. That behavior is another side-affect of balpha's changes to the hyperlink regex which now auto-linkifies things even when immediately surrounded by other characters.

Currently, the regex only looks for an equals sign followed by a double quotation (=") as a preceding character set. Since a single quote is not, the entire link gets automatically linkified like so:

<a href='<>'>foo</a>
         ^              ^

which produces this HTML:

<a href='<a href=""></a>'>foo</a>

which for some reason, when added to the post directly, actually creates a link followed by the '>foo, but in reality should create the result you're getting. When the check runs to remove invalid HTML, the main components of it are removed:

<a href='<a href=""></a>'>foo</a>

and you are left with:'>foo
share|improve this answer
This is not supposed to work, and it never was. – balpha Mar 1 '13 at 18:29
@balpha: If it's not, then shouldn't you remove the HTML first before messing it all up? I honestly don't see why it shouldn't work. – animuson Mar 1 '13 at 18:30
Actually, tweaking the regex to not auto-linkify after a single quote would still fix this for your by-design view, as the HTML would still get stripped properly in the end since the extra link isn't there. – animuson Mar 1 '13 at 18:35
I'm considering it (I already made that change to Discourse), and it makes sense for the general case, but for the Stack Overflow case it doesn't really matter; you're just creating two different kinds of being broken. – balpha Mar 1 '13 at 18:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .