topic Re: accept hosted does not work when a field contains an ampersand in Integration and Testing

accept hosted does not work when a field contains an ampersand

teicher — Wed, 23 Aug 2017 13:35:26 GMT

Hello,

I believe there is a bug with the accept hosted page. When I create a
token with an address like "22 Hill & Dale Rd" I get a the token back
successfully but when going to the accept hosted page (both dev and
prod) it sais "Missing or invalid token."

When I replace the Ampersand with plain text like "22 Hill and Dale Rd",
the accept hosted page is displayed ok.

Trying to send "22 Hill & Dale Rd" also does not help.
We think the same problem exists for names, like company
name "Frank & Selma Enterprises".

As fas as I know, an ampersand is a legal character in a JSON
string message.... What to do ?

Btw sending %26 does seem to work for simple redirect accept hosted,

but then the message received in an iFrameCommunicator is truncatd...

Thanks and kind regards,
Tom.

Re: accept hosted does not work when a field contains an ampersand

Aaron — Wed, 20 Sep 2017 19:48:36 GMT

Hi @teicher,

@teicher wrote:

Btw sending %26 does seem to work for simple redirect accept hosted,

but then the message received in an iFrameCommunicator is truncatd...

Hmmm... When I try using %26 on my end, I get the full message passed to my IFrameCommunicator.html script, so I suspect there's some problem with the way that you're parsing the JSON in the message that's returned.

Re: accept hosted does not work when a field contains an ampersand

eventespresso — Thu, 08 Mar 2018 21:17:54 GMT

We're also experiencing this issue.

I noticed the authorize.net accept hosted page now has some javascript which prevents users from entering troublesome characters (like "&" or "è") in the form, so that's a partial fix.

BUT you can still pass these troublesome characters in the "getHostedPaymentPage" request, and then they will appear on the page, and then cause this same problem when submitting the form.

We got around this by just making sure we never pass any non-alphanumeric characters in the "GetHostedPaymentPage" request.

Re: accept hosted does not work when a field contains an ampersand

redcart — Sat, 03 Apr 2021 18:19:35 GMT

We also confirmed that this is still an issue and passing & in the request causes the order summary page to error out and not display the order details. The chrome devtools console shows javascript errors on the page so I believe this is a bug with Authnet's hosted accept page.

Is there somewhere where we can officially log an bug with the Authnet dev team so that they can get this fixed?

Re: accept hosted does not work when a field contains an ampersand

kschaller1979 — Thu, 19 Jun 2025 09:03:37 GMT

Encountering this problem in 2025. Company Name or Address fields have & in the data, which throws a "Invalid or Missing Token" error when the Accept Hosted form is submitted. I know the ANET API xml escapes this data prior to sending the message to their servers, but it still breaks the submission when & is escaped to &. So as a work around I have changed & to "AND" to bypass this bug, but it really is a bug because & should be allowed in the post body