Double Quotes In LOV Return Value Being Replaced With &qu ot; By APEX 4

Question

My company recently upgraded our development and test boxes to APEX 4.0.2, which we have been wanting for a while now. We discovered that since the upgrade some of our checkboxes and radio groups no longer work as expected. What I mean by this is that the return values being checked for were not correct, and on several occasions we received PL/SQL errors related to numeric to character conversion issues.
After debugging some it turns out that we have the following LOV query for one of our Checkboxes:
select
statement d,
stmt_id || '" title="&P20_FORM_STMT. ' || statement || '.' r
from
stmts
The return value for the LOV is setup so that it would return a 508 compliant checkbox. We were told we needed a title for each value of a checkbox or radio group to be 508 compliant. These titles must also be relevant to the selection being made, hence the substitution string being used in the return value.
What I discovered in all of this is that APEX 3.2 did not convert the double quotes in our return value to &qu ot;, but APEX 4.0.2 does. This causes the value of any given checkbox or radio group to look like the following:
value="1&qu ot; title=&qu ot;This is the statement that I have made."
And what we are looking for, and what APEX used to do is this:
value="1" title="This is the statement that I have made."
Does anyone know a way to prevent APEX from converting the double quotes to &qu ot;, or is there a way to insert an element attribute for each checkbox or radio group value that contains a substitution string?
Thanks in advance!
Pastey

Answer 1

ryansun wrote:
4.2.1
Hi,
I have a classic report, which has a count column that is hyperlinked. using the standard apex column hyperlink option. In that we have the option of passing values. I noticed that when I am passing a value which has "/" in it, it replaces the / with & #x2F;
I have created a application item which I am populating with the report column.
Because of which I cannot use that value in the report query.
Any suggestions?Yes. Don't pass string values in URLs. Especially where it is possible for these strings to contain URI reserved or APEX sensitive characters. This might work for a while but your application can be broken months from now by users including a "&" or ":" in data that gets passed as a URL parameter. Whilst it is possible to escape strings to make them URL- and APEX parameter-safe, it is much better practice to avoid the problem altogether.
Exposing data in the URL may also introduce security vulnerabilities. Also note that the maximum length of a URL in Microsoft Internet Explorer is about 2KB, which can easily be exceeded by throwing a few string values at it.
Only use discrete alphanumeric key values as URL parameters. In target pages/regions, use these key values to retrieve the required data using item source attributes and processes.