**Steps to replicate the issue** (include links if applicable):
# Open a wiki that has //disabled// magic links via `$wgEnableMagicLinks` (e.g. enwiki)
# Go to [[https://en.wikipedia.org/wiki/Special:ExpandTemplates|Special:ExpandTemplates]]
# Paste the sample wikitext (see below) and click "OK" to render it.
# Open a wiki that has //enabled// magic links via `$wgEnableMagicLinks` (e.g. mediawiki.org)
# Go to its [[https://www.mediawiki.org/wiki/Special:ExpandTemplates|Special:ExpandTemplates]]
# Paste the same sample wikitext and click "OK" to render it:
```
* RFC: {{anchorencode:RFC}}
* PMID: {{anchorencode:PMID}}
* ISBN: {{anchorencode:ISBN}}
* RFCAAA: {{anchorencode:RFCAAA}}
* PMIDAAA: {{anchorencode:PMIDAAA}}
* ISBNAAA: {{anchorencode:ISBNAAA}}
* RFC AAA: {{anchorencode:RFC AAA}}
* PMID AAA: {{anchorencode:PMID AAA}}
* ISBN AAA: {{anchorencode:ISBN AAA}}
```
**What happens?**:
The result for both contains the HTML character entities, introduced by [[https://github.com/wikimedia/mediawiki/blob/5c92a51f28990523d509c6171ac658fa82096859/includes/Parser/Sanitizer.php#L913-L915|function safeEncodeAttribute in Sanitizer.php]]:
```
* RFC: RFC
* PMID: PMID
* ISBN: ISBN
* RFCAAA: RFCAAA
* PMIDAAA: PMIDAAA
* ISBNAAA: ISBNAAA
* RFC AAA: RFC_AAA
* PMID AAA: PMID_AAA
* ISBN AAA: ISBN_AAA
```
**What should have happened instead?**:
* Function `safeEncodeAttribute` should skip the sanitization, when the corresponding magic links are disabled. That is, it should follow the configuration parameter `$wgEnableMagicLinks`, like function `magicLinkCallback` does in Parser.php for [[https://github.com/wikimedia/mediawiki/blob/5c92a51f28990523d509c6171ac658fa82096859/includes/Parser/Parser.php#L1734-L1737|RFC]], [[https://github.com/wikimedia/mediawiki/blob/5c92a51f28990523d509c6171ac658fa82096859/includes/Parser/Parser.php#L1743-L1746|PMID]], and [[https://github.com/wikimedia/mediawiki/blob/5c92a51f28990523d509c6171ac658fa82096859/includes/Parser/Parser.php#L1766-L1768|ISBN]].
* See also [[https://github.com/wikimedia/mediawiki/blob/5c92a51f28990523d509c6171ac658fa82096859/includes/Parser/ParserOptions.php#L814-L839|functions getMagicISBNLinks, getMagicPMIDLinks, and getMagicRFCLinks in ParserOptions.php]].
* When the sanitization is enabled, function `safeEncodeAttribute` should check slightly harder for the required syntax of magic links. It should only do the sanitization when the attribute value has a trailing space (e.g. `'ISBN ' => 'ISBN_',` instead of `'ISBN' => 'ISBN',`)
* See also [[https://www.mediawiki.org/wiki/Help:Magic_links]]
* The result of Special:ExpandTemplates for step 3 (disabled magic links) should be:
```
* RFC: RFC
* PMID: PMID
* ISBN: ISBN
* RFCAAA: RFCAAA
* PMIDAAA: PMIDAAA
* ISBNAAA: ISBNAAA
* RFC AAA: RFC_AAA
* PMID AAA: PMID_AAA
* ISBN AAA: ISBN_AAA
```
* The result of Special:ExpandTemplates for step 6 (enabled magic links) should be:
```
* RFC: RFC
* PMID: PMID
* ISBN: ISBN
* RFCAAA: RFCAAA
* PMIDAAA: PMIDAAA
* ISBNAAA: ISBNAAA
* RFC AAA: RFC_AAA
* PMID AAA: PMID_AAA
* ISBN AAA: ISBN_AAA
```
**Software version** (on `Special:Version` page; skip for WMF-hosted wikis like Wikipedia):
**Other information** (browser name/version, screenshots, etc.):
* Reported at [[https://en.wikipedia.org/wiki/Wikipedia:Village_pump_(technical)#Shortcuts_with_the_string_'RFC'_at_the_beginning_generate_corrupted_anchors|enwiki's Village pump by Mathglot]], where usage of a Lua equivalent function `mw.uri.anchorEncode` was causing this issue.
* Scribunto's [[https://github.com/wikimedia/mediawiki-extensions-Scribunto/blob/b096fdf0f18a65c0074b4c30f296b44d9f860f05/includes/Engines/LuaCommon/lualib/mw.uri.lua#L86-L89|function uri.anchorEncode in file mw.uri.lua]] calls [[https://github.com/wikimedia/mediawiki-extensions-Scribunto/blob/b096fdf0f18a65c0074b4c30f296b44d9f860f05/includes/Engines/LuaCommon/UriLibrary.php#L24-L33|function anchorEncode in PHP class UriLibrary]], which calls [[https://github.com/wikimedia/mediawiki/blob/5c92a51f28990523d509c6171ac658fa82096859/includes/Parser/CoreParserFunctions.php#L1361-L1372|CoreParserFunctions::anchorencode]], which calls the aforementioned `Sanitizer::safeEncodeAttribute`.