From 4eed1b60c37ef342ac26ed732d8e928599938cf1 Mon Sep 17 00:00:00 2001
From: Bogdan <matolq@gmail.com>
Date: Wed, 2 Sep 2026 22:29:43 +0200
Subject: [PATCH] fix: remove esc(strip_tags()) from RouteCollection default
 setters

---
 system/Router/RouteCollection.php           |  7 +++---
 tests/system/Router/RouteCollectionTest.php | 24 +++++++++++++++++++++
 user_guide_src/source/changelogs/v4.7.5.rst |  1 +
 3 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/system/Router/RouteCollection.php b/system/Router/RouteCollection.php
index 6ade80e6f9fc..916fc0f7230f 100644
--- a/system/Router/RouteCollection.php
+++ b/system/Router/RouteCollection.php
@@ -402,22 +402,21 @@ public function getPlaceholders(): array
 
     public function setDefaultNamespace(string $value): RouteCollectionInterface
     {
-        $this->defaultNamespace = esc(strip_tags($value));
-        $this->defaultNamespace = rtrim($this->defaultNamespace, '\\') . '\\';
+        $this->defaultNamespace = rtrim($value, '\\') . '\\';
 
         return $this;
     }
 
     public function setDefaultController(string $value): RouteCollectionInterface
     {
-        $this->defaultController = esc(strip_tags($value));
+        $this->defaultController = $value;
 
         return $this;
     }
 
     public function setDefaultMethod(string $value): RouteCollectionInterface
     {
-        $this->defaultMethod = esc(strip_tags($value));
+        $this->defaultMethod = $value;
 
         return $this;
     }
diff --git a/tests/system/Router/RouteCollectionTest.php b/tests/system/Router/RouteCollectionTest.php
index 5e3e7bd8015f..1a883213af64 100644
--- a/tests/system/Router/RouteCollectionTest.php
+++ b/tests/system/Router/RouteCollectionTest.php
@@ -272,6 +272,14 @@ public function testSetDefaultControllerStoresIt(): void
         $this->assertSame('godzilla', $routes->getDefaultController());
     }
 
+    public function testSetDefaultControllerPreservesSpecialCharacters(): void
+    {
+        $routes = $this->getCollector();
+        $routes->setDefaultController('Foo&Bar');
+
+        $this->assertSame('Foo&Bar', $routes->getDefaultController());
+    }
+
     public function testSetDefaultMethodStoresIt(): void
     {
         $routes = $this->getCollector();
@@ -280,6 +288,22 @@ public function testSetDefaultMethodStoresIt(): void
         $this->assertSame('biggerBox', $routes->getDefaultMethod());
     }
 
+    public function testSetDefaultMethodPreservesSpecialCharacters(): void
+    {
+        $routes = $this->getCollector();
+        $routes->setDefaultMethod('get&set');
+
+        $this->assertSame('get&set', $routes->getDefaultMethod());
+    }
+
+    public function testSetDefaultNamespacePreservesSpecialCharacters(): void
+    {
+        $routes = $this->getCollector();
+        $routes->setDefaultNamespace('App\Controllers&Services');
+
+        $this->assertSame('App\Controllers&Services\\', $routes->getDefaultNamespace());
+    }
+
     public function testTranslateURIDashesWorks(): void
     {
         $routes = $this->getCollector();
diff --git a/user_guide_src/source/changelogs/v4.7.5.rst b/user_guide_src/source/changelogs/v4.7.5.rst
index 47d447dfbbc3..dfe2ea064cfc 100644
--- a/user_guide_src/source/changelogs/v4.7.5.rst
+++ b/user_guide_src/source/changelogs/v4.7.5.rst
@@ -39,6 +39,7 @@ Bugs Fixed
 - **Helpers:** Fixed a bug where ``get_dir_file_info()`` returned incomplete entries for subdirectories and missing files instead of omitting them.
 - **Honeypot:** Fixed a bug where bot detection returned an HTTP 500 response instead of 403 (Forbidden).
 - **Logger:** Fixed a bug where interpolating a log message with array or non-stringable context values could raise PHP warnings or errors.
+- **Router:** Fixed a bug where ``RouteCollection::setDefaultNamespace()``, ``setDefaultController()``, and ``setDefaultMethod()`` incorrectly applied ``esc(strip_tags())``, which encoded HTML entities in PHP identifiers.
 
 See the repo's
 `CHANGELOG.md <https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md>`_