Index: src/style.c
==================================================================
--- src/style.c
+++ src/style.c
@@ -90,11 +90,13 @@
   va_list ap;
   va_start(ap, zFormat);
   zUrl = vmprintf(zFormat, ap);
   va_end(ap);
   if( g.perm.Hyperlink && !g.javascriptHyperlink ){
-    return mprintf("<a %s href=\"%z\">", zExtra, zUrl);
+    char *zHUrl = mprintf("<a %s href=\"%h\">", zExtra, zUrl);
+    fossil_free(zUrl);
+    return zHUrl;
   }
   if( nHref>=nHrefAlloc ){
     nHrefAlloc = nHrefAlloc*2 + 10;
     aHref = fossil_realloc(aHref, nHrefAlloc*sizeof(aHref[0]));
   }
@@ -106,11 +108,13 @@
   va_list ap;
   va_start(ap, zFormat);
   zUrl = vmprintf(zFormat, ap);
   va_end(ap);
   if( g.perm.Hyperlink && !g.javascriptHyperlink ){
-    return mprintf("<a href=\"%z\">", zUrl);
+    char *zHUrl = mprintf("<a href=\"%h\">", zUrl);
+    fossil_free(zUrl);
+    return zHUrl;
   }
   if( nHref>=nHrefAlloc ){
     nHrefAlloc = nHrefAlloc*2 + 10;
     aHref = fossil_realloc(aHref, nHrefAlloc*sizeof(aHref[0]));
   }
@@ -278,11 +282,11 @@
     for(i=0; i<nSubmenu; i++){
       struct Submenu *p = &aSubmenu[i];
       if( p->zLink==0 ){
         @ <span class="label">%h(p->zLabel)</span>
       }else{
-        @ <a class="label" href="%s(p->zLink)">%h(p->zLabel)</a>
+        @ <a class="label" href="%h(p->zLink)">%h(p->zLabel)</a>
       }
     }
     @ </div>
   }
   style_ad_unit();

Index: src/timeline.c
==================================================================
--- src/timeline.c
+++ src/timeline.c
@@ -373,11 +373,11 @@
     /* Generate the "user: USERNAME" at the end of the comment, together
     ** with a hyperlink to another timeline for that user.
     */
     if( zTagList && zTagList[0]==0 ) zTagList = 0;
     if( g.perm.Hyperlink && fossil_strcmp(zUser, zThisUser)!=0 ){
-      char *zLink = mprintf("%R/timeline?u=%h&amp;c=%t&amp;nd", zUser, zDate);
+      char *zLink = mprintf("%R/timeline?u=%h&c=%t&amp;nd", zUser, zDate);
       @ (user: %z(href("%z",zLink))%h(zUser)</a>%s(zTagList?",":"\051")
     }else{
       @ (user: %h(zUser)%s(zTagList?",":"\051")
     }
 
@@ -398,11 +398,11 @@
         while( z && z[0] ){
           for(i=0; z[i] && (z[i]!=',' || z[i+1]!=' '); i++){}
           if( zThisTag==0 || memcmp(z, zThisTag, i)!=0 || zThisTag[i]!=0 ){
             blob_appendf(&links,
                   "%z%#h</a>%.2s",
-                  href("%R/timeline?r=%#t&amp;nd&amp;c=%t",i,z,zDate), i,z, &z[i]
+                  href("%R/timeline?r=%#t&nd&c=%t",i,z,zDate), i,z, &z[i]
             );
           }else{
             blob_appendf(&links, "%#h", i+2, z);
           }
           if( z[i]==0 ) break;

Index: src/url.c
==================================================================
--- src/url.c
+++ src/url.c
@@ -352,11 +352,11 @@
       z = zValue2;
       if( z==0 ) continue;
     }
     blob_appendf(&p->url, "%s%s", zSep, p->azName[i]);
     if( z && z[0] ) blob_appendf(&p->url, "=%T", z);
-    zSep = "&amp;";
+    zSep = "&";
   }
   if( zName1 && zValue1 ){
     blob_appendf(&p->url, "%s%s", zSep, zName1);
     if( zValue1[0] ) blob_appendf(&p->url, "=%T", zValue1);
   }