Adding map layers with & in the url fails

[JasonSanford]

When I try to add a custom tile layer like

http://tileify-ags.herokuapp.com/tiles/{z}/{x}/{y}?url=http%3A%2F%2Fgis-web.co.union.nc.us%2Farcgis%2Frest%2Fservices%2FPWGIS_Web%2FOperational_Layers%2FMapServer&transparent=true&layers=show%3A49

, the escape-html module, added here, converts the & to & and the result is tile requests that look like

http://tileify-ags.herokuapp.com/tiles/15/9043/12972?url=http%3A%2F%2Fgis-web.co.union.nc.us%2Farcgis%2Frest%2Fservices%2FPWGIS_Web%2FOperational_Layers%2FMapServer&transparent=true&layers=show%3A49

The transparent and layers url parameters are not preserved.

I saw a comment in #430 that someone could add images with javascript urls. I guess this could be the reason for escaping?

If so, this makes sense for protecting against cross-site scripting, but do you know of a reliable way to pass url parameters into a tile layer url and have them preserved?

[CHENJIAMIAN]

Tile numbering genres of major map vendors in China

Map provider tile coding layer link
AutoNavi Map Google XYZ Road http://webrd02.is.autonavi.com/appmaptile?lang=zh_cn&size=1&scale=1&style=8&x=105&y=48&z=7
AutoNavi Map Google XYZ Satellite http ://webst04.is.autonavi.com/appmaptile?style=6&x=843&y=388&z=10
Google Map Google XYZ Road http://mt2.google.cn/vt/lyrs=m&hl=zh-CN&gl=cn&x=105&y =48&z=
7Google Maps Google XYZ Satellite http://mt2.google.cn/vt/lyrs=s&hl=zh-CN&gl=cn&x=105&y=48&z=7Google
Maps Google XYZ Terrain http://mt0.google.cn /vt/lyrs=t&hl=zh-CN&gl=cn&x=420&y=193&z=9
OpenStreetMap Google XYZ road http://a.tile.openstreetmap.org/7/105/48.png
Tencent map TMS road http://rt1 .map.gtimg.com/realtimerender?z=7&x=105&y=79&type=vector&
style=0 Bing map QuadTree roadhttp://r1.tiles.ditu.live.com/tiles/r1321001.png?g=100&mkt=zh-cn
Baidu map Baidu XYZ road http://online4.map.bdimg.com/tile/?qt=tile&x =98&y=36&z=9&;styles=pl&scaler=1&udt=20170406
Baidu Map Baidu XYZ Traffic http://its.map.baidu.com:8002/traffic/TrafficTileService?level=19&x=99052&y=20189&time=1373790856265&label=web2D&;v =017

& escape-html to amp; cause all 404