WordPress theme is eliminating my PayPal purchase link's ampersand and all text afterwards

Question

I've encountered a strange error in a theme called "Faith" (by Chimpstudio). When user publishes or updates the page, the PayPal link doesn't write to the database properly.

As far as I'm aware, the value being written to the database is contained in an XML array, like so:

noSimpleXMLElement Object ( [0] => https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick )

The link that should be publishing/updating (before hitting Publish/Update) is:

https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=XXXXXXXXXXXXX

The "&hosted_button_id=XXXXXXXXXXXXX" is not being saved, which means users cannot purchase my client's product.

Potential solution: I've been digging through the theme's .php files, looking for an opportunity to intercept the value being passed to the WordPress database. The idea was to wrap/encode the variable before it gets send to the WP database, with the hope that the entire URL string remains unchanged at the "&hosted_button_id=XXXXXXXXXXXXX" part of the URL.

Any solutions or ideas which may help?

EDIT: This may be a relevant piece of code from the admin_functions.php file:

function events_meta_save($post_id) {

    global $wpdb;

    if (empty($_POST["event_ticket_price"])){ $_POST["event_ticket_price"] = "";}

    if (empty($_POST["event_social_sharing"])){ $_POST["event_social_sharing"] = "";}

    if (empty($_POST["event_buy_now"])){ $_POST["event_buy_now"] = "";}

    if (empty($_POST["event_phone_no"])){ $_POST["event_phone_no"] = "";}

    if (empty($_POST["switch_footer_widgets"])){ $_POST["switch_footer_widgets"] = "";}

    if (empty($_POST["event_start_time"])){ $_POST["event_start_time"] = "";}

    if (empty($_POST["event_end_time"])){ $_POST["event_end_time"] = "";}

    if (empty($_POST["event_all_day"])){ $_POST["event_all_day"] = "";}

    if (empty($_POST["event_address"])){ $_POST["event_address"] = "";}

     if (empty($_POST["event_ticket_options"])){ $_POST["event_ticket_options"] = "";}

    if (empty($_POST["event_map"])){ $_POST["event_map"] = "";}


    $sxe = new SimpleXMLElement("<event></event>");


        $sxe->addChild('event_ticket_price', $_POST['event_ticket_price'] );


        $sxe->addChild('event_social_sharing', $_POST["event_social_sharing"]);

        $sxe->addChild('event_buy_now', $_POST["event_buy_now"]);

        $sxe->addChild('event_phone_no', $_POST["event_phone_no"]);

        $sxe->addChild('switch_footer_widgets', $_POST["switch_footer_widgets"]);

        $sxe->addChild('event_start_time', $_POST["event_start_time"]);

        $sxe->addChild('event_end_time', $_POST["event_end_time"]);

        $sxe->addChild('event_all_day', $_POST["event_all_day"]);

        $sxe->addChild('event_ticket_options', $_POST["event_ticket_options"]);

        $sxe->addChild('event_address', $_POST["event_address"]);

        $sxe->addChild('event_map', $_POST["event_map"]);

    echo "<pre>BPOST: ".print_r($_POST, true)."</pre>";
    print_r($sxe);

    $sxe = save_layout_xml($sxe);
    print_r($sxe);
    update_post_meta($post_id, 'cs_event_meta', $sxe->asXML());

}

Additionally, here's more code for the XML side from the events.php file:

// event custom fields start
add_action( 'add_meta_boxes', 'cs_event_meta' );  
function cs_event_meta()
{
    add_meta_box( 'event_meta', 'Event Options', 'cs_event_meta_data', 'events', 'normal', 'high' );
}
function cs_event_meta_data($post) {
    $cs_event_meta = get_post_meta($post->ID, "cs_event_meta", true);
    global $cs_xmlObject;
    if ( $cs_event_meta <> "" ) {
        $cs_xmlObject = new SimpleXMLElement($cs_event_meta);
            $event_ticket_price = $cs_xmlObject->event_ticket_price;
            $event_social_sharing = $cs_xmlObject->event_social_sharing;
            $event_start_time = $cs_xmlObject->event_start_time;
            $event_end_time = $cs_xmlObject->event_end_time;
            $event_all_day = $cs_xmlObject->event_all_day;
            $event_address = $cs_xmlObject->event_address;
            $event_loc_lat = $cs_xmlObject->event_loc_lat;
            $event_loc_long = $cs_xmlObject->event_loc_long;
            $event_loc_zoom = $cs_xmlObject->event_loc_zoom;

            $testVar = $cs_xmlObject->event_buy_now;

            if (strstr($cs_xmlObject->event_buy_now, "&amp;"))
            {
                echo "yes"; //$event_buy_now = ($cs_xmlObject->event_buy_now . 'FINDME(yes)');
                print_r ($testVar);
            }
            else
            {
                echo "no"; //$event_buy_now = ($cs_xmlObject->event_buy_now . 'FINDME(no)');
                print_r ($testVar);
                print_r ($cs_xmlObject);
            }

            $event_ticket_options = $cs_xmlObject->event_ticket_options;
            $event_map = $cs_xmlObject->event_map;
    }
    else {
        $event_ticket_price = '';
        $slider_id = '';

        $event_social_sharing = '';
        $event_related = '';
        $event_start_time = '';
        $event_end_time = '';
        $event_all_day = '';
        $event_address = '';
        $event_loc_lat = '';
        $event_loc_long = '';
        $event_loc_zoom = '';
        $inside_event_related_post_title = '';
        $event_map = '';
        $event_buy_now = '';
        $event_ticket_options = '';
    }

NOTE: Both of these code snippets are located in the parent theme's /include/ directory. At this point, there is no child theme -- and if necessary, a child theme will be created to implement these updates.

Answer 1

Just use jQuery and .change() to detect new content in an input. When the field gets changed, have it change the & to & amp; Might be a dirty hack, but if this is standing between you and payday, have at 'er.