It seems that some property controls don't htmlencode their output. For example, I have a property rendering a PageLink, and the name of the page includes an ampersand, which shuld be encoded as &, but the linked text includes a cleartext ampersand. The same seems to go for links inserted in xhtml properties.
Using Reflector I looked at the rendering code, and the page name seems to be run through the ToWebString() method which explicitly removes ampersands. But apparently it doesn't. This means it won't pass validation by W3C for example. Is it a bug or am I missing something?
dont think it is a bug but for htmlencoding i suggest you have a look at Fredrik Haglunds blogpost about the issues.
I suppose I'll have to use other constructs than properties when rendering menus for example, or there's the risk of the whole site not being xhtml valid. Not a big problem there, but it's a shame the Property control does not handle it. It would be even nicer for Xhtml strings.