<p>The relation roles appear to be passed through to the database without the xml character checks occurring</p>

<p><a href="https://github.com/openstreetmap/openstreetmap-website/blob/d27cc80b438b0943ac532b727b48b6ca6601f990/app/controllers/amf_controller.rb#L554">https://github.com/openstreetmap/openstreetmap-website/blob/d27cc80b438b0943ac532b727b48b6ca6601f990/app/controllers/amf_controller.rb#L554</a></p>

<p>The <code>m[2]</code> likely needs <code>m[2] = strip_non_xml_chars m[2]</code> at the same time as tags are checked ( at <a href="https://github.com/openstreetmap/openstreetmap-website/blob/d27cc80b438b0943ac532b727b48b6ca6601f990/app/controllers/amf_controller.rb#L530">https://github.com/openstreetmap/openstreetmap-website/blob/d27cc80b438b0943ac532b727b48b6ca6601f990/app/controllers/amf_controller.rb#L530</a> )</p>

<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">—<br>Reply to this email directly or <a href="https://github.com/openstreetmap/openstreetmap-website/issues/758">view it on GitHub</a>.<img alt="" height="1" src="https://github.com/notifications/beacon/1419053__eyJzY29wZSI6Ik5ld3NpZXM6QmVhY29uIiwiZXhwaXJlcyI6MTcxODQ2Mjk0OSwiZGF0YSI6eyJpZCI6MzQ2OTM3Njd9fQ==--aea937cb540c188faa9e25b5b3e28b2f7438787b.gif" width="1" /></p>