// Replace ampersands and single quotes only when displaying.
if ( 'display' == $_context ) {
- $url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url);
+ $url = wp_kses_normalize_entities( $url );
+ $url = str_replace( '&', '&', $url );
$url = str_replace( "'", ''', $url );
}