accept hosted does not work when a field contains an ampersand

[teicher]

Hello,

I believe there is a bug with the accept hosted page. When I create a
token with an address like "22 Hill & Dale Rd" I get a the token back
successfully but when going to the accept hosted page (both dev and
prod) it sais "Missing or invalid token."

When I replace the Ampersand with plain text like "22 Hill and Dale Rd",
the accept hosted page is displayed ok.

Trying to send "22 Hill & Dale Rd" also does not help.
We think the same problem exists for names, like company
name "Frank & Selma Enterprises".

As fas as I know, an ampersand is a legal character in a JSON
string message.... What to do ?

Btw sending %26 does seem to work for simple redirect accept hosted,

but then the message received in an iFrameCommunicator is truncatd...

Thanks and kind regards,
Tom.

[Aaron]

Hi @teicher,

---

@teicher wrote:

Btw sending %26 does seem to work for simple redirect accept hosted,

but then the message received in an iFrameCommunicator is truncatd...

---

Hmmm... When I try using %26 on my end, I get the full message passed to my IFrameCommunicator.html script, so I suspect there's some problem with the way that you're parsing the JSON in the message that's returned.

[eventespresso]

We're also experiencing this issue.

I noticed the authorize.net accept hosted page now has some javascript which prevents users from entering troublesome characters (like "&" or "è") in the form, so that's a partial fix.

BUT you can still pass these troublesome characters in the "getHostedPaymentPage" request, and then they will appear on the page, and then cause this same problem when submitting the form.

We got around this by just making sure we never pass any non-alphanumeric characters in the "GetHostedPaymentPage" request.

[redcart]

We also confirmed that this is still an issue and passing & in the request causes the order summary page to error out and not display the order details. The chrome devtools console shows javascript errors on the page so I believe this is a bug with Authnet's hosted accept page. 

Is there somewhere where we can officially log an bug with the Authnet dev team so that they can get this fixed?