should actually fix the bug when we note it in the changelog

docs/changelog/7.x.x.txt

@@ -1,5 +1,6 @@
 7.10.0
- - fixed #11812: Checking www_ajaxSave's response in the cart js
+ - fixed #11812: Checking www_ajaxSave's response in the cart js, urlencoding
+   post parameters
 
 7.9.13
  - fixed #11783: Instances deleted during realtime run

www/extras/shop/cart.js

@@ -305,6 +305,11 @@
                     return;
                 }
 
+                if (!id.match(/^[A-Za-z0-9_-]{22}$/)) {
+                    alert('Error: bad response trying to save address.');
+                    return;
+                }
+
                 function updateOne(dropdown) {
                     var opt = _.detect(dropdown.options, function (o) {
                         return o.text === label;
@@ -406,7 +411,7 @@
             var url   = this.baseUrl,
                 cb    = { success: success },
                 query = _(params).map(function (v, k) {
-                    return [k, v].join('=');
+                    return [k, escape(v)].join('=');
                 }).join('&');
 
             if (method === 'GET') {