Merged r3612 from trunk.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/0.9-stable@3661 e93f8b46-1217-0410-a6f0-8f06a7374b81

lib/redcloth3.rb

@@ -818,7 +818,7 @@ class RedCloth3 < String
               post = ")"+post # add closing parenth to post
             end
             atts = pba( atts )
-            atts = " href=\"#{ url }#{ slash }\"#{ atts }"
+            atts = " href=\"#{ htmlesc url }#{ slash }\"#{ atts }"
             atts << " title=\"#{ htmlesc title }\"" if title
             atts = shelve( atts ) if atts