1 files changed, 4 insertions, 0 deletions

diff --git a/inc/common.php b/inc/common.php
index 9e366e3fd..5372a17d7 100644
--- a/inc/common.php
+++ b/inc/common.php
@@ -151,11 +151,15 @@ function buildURLparams($params, $sep='&'){
 /**
  * Build an string of html tag attributes
  *
+ * Skips keys starting with '_', values get HTML encoded
+ *
  * @author Andreas Gohr
  */
 function buildAttributes($params){
   $url = '';
   foreach($params as $key => $val){
+    if($key{0} == '_') continue;
+
     $url .= $key.'="';
     $url .= htmlspecialchars ($val);
     $url .= '" ';