Merge 18a63b6d7d into 4f10e6e212

[ticket/17519] Revert cron url escape back to html_attr

phpBB/phpbb/db/driver/mysqli.php

@@ -336,7 +336,10 @@ class mysqli extends \phpbb\db\driver\mysql_base
 	*/
 	function sql_escape($msg)
 	{
-		return @mysqli_real_escape_string($this->db_connect_id, $msg);
+		return @mysqli_real_escape_string(
+			$this->db_connect_id,
+			utf8_encode_ucr($msg)
+		);
 	}
 
 	/**

phpBB/styles/all/template/cron.html

@@ -4,4 +4,4 @@
 	to hide visually and `aria-hidden="true"` to hide from screen-readers; using
 	`hidden` or `display: none` would prevent the task from running.
 #}
-<img class="sr-only" aria-hidden="true" src="{{ CRON_TASK_URL|e('url') }}" width="1" height="1" alt="">
+<img class="sr-only" aria-hidden="true" src="{{ CRON_TASK_URL|e('html_attr') }}" width="1" height="1" alt="">

tests/cron/wrapper_test.php

@@ -60,7 +60,7 @@ class phpbb_cron_wrapper_test extends phpbb_template_template_test_case
 			$this->template
 		);
 
-		$this->assertEquals('<img class="sr-only" aria-hidden="true" src="app.php%2Fcron%2Ffoo%3Ff%3D5" width="1" height="1" alt="">', str_replace(["\n", "\t"], '', $this->wrapper->get_html_tag()));
+		$this->assertEquals('<img class="sr-only" aria-hidden="true" src="app.php&#x2F;cron&#x2F;foo&#x3F;f&#x3D;5" width="1" height="1" alt="">', str_replace(["\n", "\t"], '', $this->wrapper->get_html_tag()));
 	}
 
 	public function test_is_parametrized_false()