title: Why is "&reg" being rendered as "®" without the bounding semicolon
body: <p>I've been running into a problem that was revealed through our Google adwords-driven marketing campaign.  One of the standard parameters used is "region".  When a user searches and clicks on a sponsored link, Google generates a long URL to track the click and sends a bunch of stuff along in the referrer.  We capture this for our records, and we've noticed that the "Region" parameter is coming through incorrectly.  What should be</p>
  
  <pre class="lang-none prettyprint-override"><code>http://ravercats.com/meow?foo=bar&amp;region=catnip
  </code></pre>
  
  <p>is instead coming through as:</p>
  
  <pre class="lang-none prettyprint-override"><code>http://ravercats.com/meow?foo=bar®ion=catnip
  </code></pre>
  
  <p>I've verified that this occurs in all browsers.  It's my understanding that <a href="http://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_references#Character_reference_overview" rel="noreferrer">HTML entity syntax</a> is defined as follows:</p>
  
  <pre><code>&amp;VALUE;
  </code></pre>
  
  <p>where the leading boundary is the ampersand and the closing boundary is the semicolon. Seems straightforward enough.  The problem is that this isn't being respected for the ® entity, and it's wreaking all kinds of havoc throughout our system.</p>
  
  <p>Does anyone know why this is occurring?  Is it a bug in the DTD? (I'm looking for the current HTML DTD to see if I can make sense of it)  I'm trying to figure out what would be common across browsers to make this happen, thus my looking for the DTD.</p>
  
  <p>Here is a proof you can use.  Take this code, make an HTML file out of it and render it in a browser:</p>
  
  <pre><code>&lt;html&gt;
  &lt;a href="http://foo.com/bar?foo=bar&amp;region=US&amp;register=lowpass&amp;reg_test=fail&amp;trademark=correct"&gt;http://foo.com/bar?foo=bar&amp;region=US&amp;register=lowpass&amp;reg_test=fail&amp;trademark=correct&lt;/a&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p><strong>EDIT: To everyone who's suggesting that I need to escape the entire URL, the example URLs above are exactly that, examples. The real URL is coming directly from Google and I have no control over how it is constructed. These suggestions, while valid, don't answer the question: "Why is this happening".</strong> </p>