b333eb9809c523502a638a910e17abc47e2c2d09
max
  Wed Aug 3 07:09:48 2016 -0700
again trying to fix an issue with handling of ${, $}, refs #17785, #15480

diff --git src/hg/lib/hui.c src/hg/lib/hui.c
index f1604c9..f2e2ef8 100644
--- src/hg/lib/hui.c
+++ src/hg/lib/hui.c
@@ -8495,31 +8495,30 @@
     s = d;
     d = NULL;
     }
 return s;
 }
 
 char *replaceInUrl(char* url, char *idInUrl, struct cart* cart, char *db, char* seqName, int winStart, \
     int winEnd, char *track, boolean encode) 
 /* replace $$ in url with idInUrl. Supports many other wildchards 
  * XX Do we have readable docs for these parameters somewhere?
  * Look at http://genome.ucsc.edu/goldenpath/help/trackDb/trackDbHub.html */
 {
 struct dyString *uUrl = NULL;
 struct dyString *eUrl = NULL;
 char startString[64], endString[64];
-char begItem[64], endItem[64];
 char *ins[13], *outs[13];
 char *eItem = (encode ? cgiEncode(idInUrl) : cloneString(idInUrl));
 
 char *scName = NULL;
 // try to avoid the mysql query it not necessary
 if (stringIn("$n", url))
     {
     char *tmp = hScientificName(db);
     scName = replaceChars(tmp, " ", "_");
     freeMem(tmp);
     }
 
 char *taxId = NULL;
 // try to avoid the mysql query it not necessary
 if (stringIn("$taxId", url))
@@ -8561,36 +8560,34 @@
     *suffix = '\0';   /* terminate itemClone prefix */
     outs[7] = itemClone;
     outs[8] = suffixClone;
     /* small memory leak here for these cloned strings */
     /* not important for a one-time operation in a CGI that will exit */
 } else {
     outs[7] = idInUrl;	/* otherwise, these are not expected */
     outs[8] = idInUrl;	/* to be used */
 }
 
 // URL may now contain item boundaries
 ins[9] = "${";
 ins[10] = "$}";
 if (cartOptionalString(cart, "o") && cartOptionalString(cart, "t"))
     {
-    int itemBeg = cartIntExp(cart, "o"); // Should strip any unexpected commas
-    int itemEnd = cartIntExp(cart, "t");
-    safef(begItem, sizeof begItem, "%d", itemBeg);
-    safef(endItem, sizeof endItem, "%d", itemEnd);
-    outs[9] = begItem;
-    outs[10] = endItem;
+    char* itemBeg = cartString(cart, "o"); // unexpected commas?
+    char* itemEnd = cartString(cart, "t");
+    outs[9] = itemBeg;
+    outs[10] = itemEnd;
     }
 else // should never be but I am unwilling to bet the farm
     {
     outs[9] = startString;
     outs[10] = endString;
     }
 
 ins[11] = "$n";
 outs[11] = scName;
 
 ins[12] = "$taxId";
 outs[12] = taxId;
 
 uUrl = subMulti(url, ArraySize(ins), ins, outs);
 outs[0] = eItem;