<p>I am trying to create a query string of variable assignments separated by the <code>&amp;</code> symbol (ex: <code>"var1=x&amp;var2=y&amp;..."</code>). I plan to pass this string into an embedded flash file.</p>

<p>I am having trouble getting an <code>&amp;</code> symbol to show up in XSLT. If I just type <code>&amp;</code> with no tags around it, there is a problem rendering the XSLT document. If I type <code>&amp;amp;</code> with no tags around it, then the output of the document is <code>&amp;amp;</code> with no change. If I type <code>&lt;xsl:value-of select="&amp;" /&gt;</code> or <code>&lt;xsl:value-of select="&amp;amp;" /&gt;</code> I also get an error. Is this possible? Note: I have also tried <code>&amp;amp;amp;</code> with no success.</p>

[{'answer_id': 67876, 'author': 'Thunder3', 'author_id': 2832, 'author_profile': 'https://Stackoverflow.com/users/2832', 'pm_score': 3, 'selected': False, 'text': '<p>Use <code>disable-output-escaping="yes"</code> in your <code>value-of</code> tag</p>\n'}, {'answer_id': 67886, 'author': 'Jim Lynn', 'author_id': 6483, 'author_profile': 'https://Stackoverflow.com/users/6483', 'pm_score': -1, 'selected': False, 'text': '<p>try:\n    &lt;xsl:value-of select="&amp;amp;" disable-output-escaping="yes"/></p>\n\n<p>Sorry if the formatting is messed up.</p>\n'}, {'answer_id': 67892, 'author': 'tomasr', 'author_id': 10292, 'author_profile': 'https://Stackoverflow.com/users/10292', 'pm_score': 0, 'selected': False, 'text': '<p>Using the <code>disable-output-escaping</code> attribute (a boolean) is probably the easiest way of accomplishing this. Notice that you can use this not only on <code>&lt;xsl:value-of/&gt;</code> but also with <code>&lt;xsl:text&gt;</code>, which might be cleaner, depending on your specific case. </p>\n\n<p>Here\'s the relevant part of the specification: <a href="http://www.w3.org/TR/xslt#disable-output-escaping" rel="nofollow noreferrer">http://www.w3.org/TR/xslt#disable-output-escaping</a></p>\n'}, {'answer_id': 67924, 'author': 'rjray', 'author_id': 6421, 'author_profile': 'https://Stackoverflow.com/users/6421', 'pm_score': 2, 'selected': False, 'text': '<p>If you are creating a query string as part of a larger URL in an attribute of some other tag (like "embed"), then you actually <em>want</em> the &amp; to be escaped as &amp;amp;. While all browsers will figure out what you mean and Do The Right Thing, if you were to pass your generated doc to a validator it would flag the un-escaped &amp; in the attribute value.</p>\n'}, {'answer_id': 67931, 'author': 'user4010', 'author_id': 4010, 'author_profile': 'https://Stackoverflow.com/users/4010', 'pm_score': 3, 'selected': False, 'text': '<p>Are you expressing the URI in HTML or XHTML?  e.g. <code>&lt;tag attr="http://foo.bar/?key=value&amp;amp;key2=value2&amp;amp;..."/&gt;</code>  If so, "<code>&amp;amp;</code>" is the correct way to express an ampersand in an attribute value, even if it looks different from than literal URI you want.  Browsers will decode "<code>&amp;amp;</code>" and any other character entity reference before either loading them or passing them to Flash.  To embed a literal, lone "<code>&amp;</code>" directly in HTML or XHTML is incorrect.</p>\n\n<p>I also personally recommend learning more about XML in order to think about these kinds of things in a clearer way.  For instance, try using the W3C DOM more (for more than just trivial Javascript); even if you don\'t use it day-to-day, learning the DOM helped me think about the tree structure of XML correctly and how to think about correctly encoding attributes and elements.</p>\n'}, {'answer_id': 71297, 'author': 'ashirley', 'author_id': 6950, 'author_profile': 'https://Stackoverflow.com/users/6950', 'pm_score': 2, 'selected': False, 'text': '<p>If you are trying to produce an XML file as output, you will want to produce <code>&amp;amp;</code> (as <code>&amp;</code> on it\'s own is invalid XML). If you are just producing a string then you should set the output mode of the stylesheet to <code>text</code> by including the following as a child of the <code>xsl:stylesheet</code></p>\n\n<pre><code>&lt;xsl:output method="text"/&gt;\n</code></pre>\n\n<p>This will prevent the stylesheet from escaping things and <code>&lt;xsl:value-of select="\'&amp;amp;\'" /&gt;</code> should produce <code>&amp;</code>.</p>\n'}, {'answer_id': 86934, 'author': 'Community', 'author_id': -1, 'author_profile': 'https://Stackoverflow.com/users/-1', 'pm_score': 0, 'selected': False, 'text': '<p>You should note, that you can use disable-output-escaping within the value of node or string/text like:</p>\n\n<pre><code>&lt;xsl:value-of select="/node/here" disable-output-escaping="yes" /&gt;\n</code></pre>\n\n<p>or</p>\n\n<pre><code>&lt;xsl:value-of select="\'&amp;amp;\'" disable-output-escaping="yes" /&gt;\n&lt;xsl:text disable-output-escaping="yes"&gt;Texas A&amp;amp;M&lt;/xsl:text&gt;\n</code></pre>\n\n<p><em>Note the single quotes in the xsl:value-of.</em></p>\n\n<p>However you cannot use disable-output-escaping on attributes. I know it\'s completely messed up but, that\'s the way things are in XSLT 1.0. So the following will <strong>NOT</strong> work:</p>\n\n<pre><code>&lt;xsl:value-of select="/node/here/@ttribute" disable-output-escaping="yes" /&gt;\n</code></pre>\n\n<p>Because in the fine print is the quote:</p>\n\n<blockquote>\n  <p>Thus, it is an <strong><em>error</em></strong> to disable output\n  escaping for an <code>&lt;xsl:value-of /&gt;</code> or\n  <code>&lt;xsl:text /&gt;</code> element that is used to\n  generate the string-value of a\n  comment, processing instruction or\n  <strong>attribute node</strong>;</p>\n</blockquote>\n\n<p><em>emphasis mine.</em></p>\n\n<p>Taken from: <a href="http://www.w3.org/TR/xslt#disable-output-escaping" rel="nofollow noreferrer">http://www.w3.org/TR/xslt#disable-output-escaping</a></p>\n'}, {'answer_id': 142408, 'author': 'Kevin Hakanson', 'author_id': 22514, 'author_profile': 'https://Stackoverflow.com/users/22514', 'pm_score': 4, 'selected': False, 'text': '<p>You can combine <code>disable-output-escaping</code> with a <code>CDATA</code> section. Try this:</p>\n\n<pre><code>&lt;xsl:text disable-output-escaping="yes"&gt;&lt;![CDATA[&amp;]]&gt;&lt;/xsl:text&gt;\n</code></pre>\n'}, {'answer_id': 180943, 'author': 'Robert Rossney', 'author_id': 19403, 'author_profile': 'https://Stackoverflow.com/users/19403', 'pm_score': 2, 'selected': False, 'text': "<p>If your transform is emitting an XML document, you shouldn't disable output escaping.  You <em>want</em> markup characters to be escaped in the output, so that you don't emit malformed XML.  The XML object that you're processing the output with (e.g. a DOM) will unescape the text for you.</p>\n\n<p>If you're using string manipulation instead of an XML object to process the output, you have a problem.  But the problem's not with your XSLT, it's with the decision to use string manipulation to process XML, which is almost invariably a bad one.</p>\n\n<p>If your transform is emitting HTML or text (and you've set the output type on the <code>&lt;xsl:output&gt;</code> element, right?), it's a different story.  Then it's appropriate to use <code>disable-output-escaping='yes'</code> on your <code>&lt;xsl:value-of&gt;</code> element.</p>\n\n<p>But in any case, you'll need to escape the markup characters in your XSLT's text nodes, unless you've wrapped the text in a CDATA section.</p>\n"}, {'answer_id': 24011840, 'author': 'Taran', 'author_id': 1504072, 'author_profile': 'https://Stackoverflow.com/users/1504072', 'pm_score': 1, 'selected': False, 'text': '<p>Disable output escaping will do the job......as this attribute is supported for a text only you can manipulate the template also eg:</p>\n\n<pre><code> &lt;xsl:variable name="replaced"&gt;\n\n    &lt;xsl:call-template name=\'app\'&gt;\n      &lt;xsl:with-param name=\'name\'/&gt;       \n    &lt;/xsl:call-template&gt;\n  &lt;/xsl:variable&gt;\n\n\n&lt;xsl:value-of select="$replaced" disable-output-escaping="yes"/&gt;\n</code></pre>\n\n<p>---> Wrapped the template call in a variable and used disable-output-escaping="yes"..</p>\n'}, {'answer_id': 33093620, 'author': 'Dimitre Novatchev', 'author_id': 36305, 'author_profile': 'https://Stackoverflow.com/users/36305', 'pm_score': 4, 'selected': False, 'text': '<blockquote>\n  <p>I am trying to create a query string of variable assignments separated\n  by the <code>&amp;</code> symbol (ex: <code>"var1=x&amp;var2=y&amp;..."</code>). I plan to pass this\n  string into an embedded flash file.</p>\n  \n  <p>I am having trouble getting an <code>&amp;</code> symbol to show up in XSLT.</p>\n</blockquote>\n\n<p><strong>Here is a runnable, short and complete demo how to produce such URL:</strong></p>\n\n<pre><code>&lt;xsl:stylesheet version="1.0"  xmlns:xsl="http://www.w3.org/1999/XSL/Transform"&gt;\n &lt;xsl:output method="text"/&gt;\n\n &lt;xsl:variable name="vX" select="\'x\'"/&gt;\n &lt;xsl:variable name="vY" select="\'y\'"/&gt;\n &lt;xsl:variable name="vZ" select="\'z\'"/&gt;\n\n  &lt;xsl:template match="/"&gt;\n    &lt;xsl:value-of select=\n"concat(\'http://www.myUrl.com/?vA=a&amp;amp;vX=\', $vX, \'&amp;amp;vY=\', $vY, \'&amp;amp;vZ=\', $vZ)"/&gt;\n  &lt;/xsl:template&gt;\n&lt;/xsl:stylesheet&gt;\n</code></pre>\n\n<p><strong>When this transformation is applied on any source XML document (ignored)</strong>:</p>\n\n<pre><code>&lt;t/&gt;\n</code></pre>\n\n<p><strong>the wanted, correct result is produced:</strong></p>\n\n<pre><code>http://www.myUrl.com/?vA=a&amp;vX=x&amp;vY=y&amp;vZ=z\n</code></pre>\n\n<p>As for the other issues raised in the question:</p>\n\n<blockquote>\n  <p>If I type <code>&amp;amp;</code> with no tags around it, then the output of the\n  document is <code>&amp;amp;</code> with no change.</p>\n</blockquote>\n\n<p>The above statement simply isn\'t true ... Just run the transformation above and look at the result.</p>\n\n<p><strong>What really is happening</strong>: </p>\n\n<p>The result you are seeing is absolutely correct, however your output method is <code>html</code> or <code>xml</code> (the default value for <code>method=</code>), therefore the serializer of the XSLT processor must represent the correct result -- the string <code>http://www.myUrl.com/?vA=a&amp;vX=x&amp;vY=y&amp;vZ=z</code>  -- as (part of) a text node in a well-formed XML document or in an HTML tree.</p>\n\n<p>By definition in a well-formed XML document a literal ampersand must be escaped by a character reference, such as the built-in <code>&amp;amp;</code> or <code>&amp;#38;</code>, or <code>&amp;#x26;</code></p>\n\n<p><strong>Remember</strong>: A string that is represented as (part of) an XML text node, or within an HTML tree,  may not look like the same string when represented as text. Nevertheless, these are two different representations of the same string.</p>\n\n<p><strong>To better understand this simple fact, do the following</strong>:</p>\n\n<p>Take the above transformation and replace the <code>xsl:output</code> declaration:</p>\n\n<pre><code> &lt;xsl:output method="text"/&gt;\n</code></pre>\n\n<p>with this one:</p>\n\n<pre><code> &lt;xsl:output method="xml"/&gt;\n</code></pre>\n\n<p>Also, surround the output in a single XML element. You may also try to use different escapes for the ampersand. The transformation may now look like this:</p>\n\n<pre><code>&lt;xsl:stylesheet version="1.0"  xmlns:xsl="http://www.w3.org/1999/XSL/Transform"&gt;\n &lt;xsl:output omit-xml-declaration="yes" method="xml"/&gt;\n\n &lt;xsl:variable name="vX" select="\'x\'"/&gt;\n &lt;xsl:variable name="vY" select="\'y\'"/&gt;\n &lt;xsl:variable name="vZ" select="\'z\'"/&gt;\n\n  &lt;xsl:template match="/"&gt;\n        &lt;t&gt;\n            &lt;xsl:value-of select=\n "concat(\'http://www.myUrl.com/?vA=a&amp;amp;vX=\', $vX, \'&amp;#38;vY=\', $vY, \'&amp;#x26;vZ=\', $vZ)"/&gt;\n        &lt;/t&gt;\n  &lt;/xsl:template&gt;\n&lt;/xsl:stylesheet&gt;\n</code></pre>\n\n<p><strong>And the result is</strong>:</p>\n\n<pre><code>&lt;t&gt;http://www.myUrl.com/?vA=a&amp;amp;vX=x&amp;amp;vY=y&amp;amp;vZ=z&lt;/t&gt;\n</code></pre>\n\n<p>You will get the same result with output method <code>html</code>.</p>\n\n<p><strong>Question</strong>:</p>\n\n<p>Is the URL that is output different (or even "damaged") than the one output in the first transformation?</p>\n\n<p><strong>Answer</strong>:</p>\n\n<p>No, in both cases the same string was output -- however in each case a different <strong>representation</strong> of the string was used.</p>\n\n<p><strong>Question</strong>:</p>\n\n<p>Must I use the DOE (<code>disable-output-escaping="yes"</code>) attribute in order to output the wanted URL?</p>\n\n<p><strong>Answer</strong>:</p>\n\n<p>No, as shown in the first transformation.</p>\n\n<p><strong>Question</strong>:</p>\n\n<p>Is it recommended to use the DOE (<code>disable-output-escaping="yes"</code>) attribute in order to output the wanted URL?</p>\n\n<p><strong>Answer</strong>:</p>\n\n<p>No, using DOE is a bad practice in XSLT and usually a signal that the programmer doesn\'t have a good grasp of the XSLT processing model. Also, DOE is only an optional feature of XSLT 1.0 and it is possible that your XSLT processor doesn\'t implement DOE, or even if it does, you could have problems running the same transformation with another XSLT processor.</p>\n\n<p><strong>Question</strong></p>\n\n<blockquote>\n  <p>I came from a different problem to the question i made a bounty for.\n  My problem: i try to generate this onclick method: </p>\n\n<pre><code>    &lt;input type="submit" \nonClick="return confirm(\'are you sure?\') &amp;&amp; confirm(\'seriously?\');" /&gt;\n</code></pre>\n  \n  <p>what i can make is: i can place the confirms in a function ... but its\n  buggin me that i can not make a &amp; inside a attribute! The solve of\n  this question is the solve of my problem i think.</p>\n</blockquote>\n\n<p><strong>Answer</strong></p>\n\n<p>Actually, you can specify the <code>&amp;&amp;</code> Boolean operation inside a JavaScript expression inside an attribute, by representing it as <code>&amp;amp;&amp;amp;</code></p>\n\n<p><strong>Here is a complete example</strong>, that everyone can run, as I did on three browsers: Chrome, Firefox 41.1.01 and IE11:</p>\n\n<p><strong>HTML</strong>:</p>\n\n<pre><code>&lt;!DOCTYPE html&gt; \n\n    &lt;html&gt; \n      &lt;head&gt; \n        &lt;link rel="stylesheet" href="style.css"&gt; \n        &lt;script src="script.js"&gt;&lt;/script&gt; \n      &lt;/head&gt; \n      &lt;body&gt; \n        &lt;h1&gt;Hello Plunker!&lt;/h1&gt; \n        &lt;input type="submit" \nonClick="alert(confirm(\'are you sure?\') &amp;amp;&amp;amp; confirm(\'seriously?\'));" /&gt; \n      &lt;/body&gt; \n    &lt;/html&gt;\n</code></pre>\n\n<p><strong>JavaScript</strong> (script.js):</p>\n\n<pre><code>function confirm(message) { \n  alert(message); \n  return message === \'are you sure?\'; \n\n}\n</code></pre>\n\n<p><strong>When you run this, you\'ll first get this alert:</strong></p>\n\n<p><a href="https://i.stack.imgur.com/OvZms.png" rel="noreferrer"><img src="https://i.stack.imgur.com/OvZms.png" alt="enter image description here"></a></p>\n\n<p>Then, after clicking the <code>OK</code> button, you\'ll get the second alert:</p>\n\n<p><a href="https://i.stack.imgur.com/oWoUQ.png" rel="noreferrer"><img src="https://i.stack.imgur.com/oWoUQ.png" alt="enter image description here"></a></p>\n\n<p>And after clicking <code>OK</code> you\'ll finally get the alert that produces the result of the <code>&amp;&amp;</code> operation:</p>\n\n<p><a href="https://i.stack.imgur.com/gJBal.png" rel="noreferrer"><img src="https://i.stack.imgur.com/gJBal.png" alt="enter image description here"></a></p>\n\n<p>You may play with this code by varying the values of the arguments passed to the <code>confirm()</code> function and you will verify that the produced results are those of using the <code>&amp;&amp;</code> operator.</p>\n\n<p>For example, if you change the <code>&lt;input&gt;</code> element to this:</p>\n\n<pre><code>&lt;input type="submit" \nonClick="alert(confirm(\'really sure?\') &amp;amp;&amp;amp; confirm(\'seriously?\'));" /&gt; \n</code></pre>\n\n<p>You\'ll get first this alert:</p>\n\n<p><a href="https://i.stack.imgur.com/qRt3W.png" rel="noreferrer"><img src="https://i.stack.imgur.com/qRt3W.png" alt="enter image description here"></a></p>\n\n<p>And when you click <code>OK</code>, you\'ll immediately get the final result of the <code>&amp;&amp;</code> operation:</p>\n\n<p><a href="https://i.stack.imgur.com/9kpym.png" rel="noreferrer"><img src="https://i.stack.imgur.com/9kpym.png" alt="enter image description here"></a></p>\n\n<p>The second alert is skipped, because the 1st operand of the <code>&amp;&amp;</code> operation was <code>false</code> and JavaScript is shortcutting an <code>&amp;&amp;</code> where the 1st operand is <code>false</code>.</p>\n\n<p><strong>To summarize</strong>: </p>\n\n<p>It is easy to use the <code>&amp;&amp;</code> operator inside an attribute, in an HTML document generated by XSLT,  by specifying the <code>&amp;&amp;</code> operand as <code>&amp;amp;&amp;amp;</code></p>\n'}, {'answer_id': 35429651, 'author': 'Ram', 'author_id': 5934422, 'author_profile': 'https://Stackoverflow.com/users/5934422', 'pm_score': 1, 'selected': False, 'text': '<p>Just replace &amp; with </p>\n\n<pre><code>&lt;![CDATA[&amp;]]&gt;\n</code></pre>\n\n<p>in the data.\nEX: Data XML</p>\n\n<pre><code>&lt;title&gt;Empire &lt;![CDATA[&amp;]]&gt; Burlesque&lt;/title&gt;\n</code></pre>\n\n<p>XSLT tag:</p>\n\n<pre><code>&lt;xsl:value-of select="title" /&gt;\n</code></pre>\n\n<p>Output: \nEmpire &amp; Burlesque</p>\n'}, {'answer_id': 54361599, 'author': 'Peter Dolland', 'author_id': 10966296, 'author_profile': 'https://Stackoverflow.com/users/10966296', 'pm_score': 0, 'selected': False, 'text': '<p>org.apache.xalan.xslt.Process, version 2.7.2 outputs to the "Here is a runnable, short and complete demo how to produce such URL" mentioned above:</p>\n\n<pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;http://www.myUrl.com/?vA=a&amp;amp;vX=x&amp;amp;vY=y&amp;amp;vZ=z11522\n</code></pre>\n\n<p>The XML declaration is suppressed with an additional <code>omit-xml-declaration="yes"</code>, but however with output <code>method="text"</code> escaping the ampersands is not justifiable.</p>\n'}]
['https://Stackoverflow.com/questions/67859', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/-1/']