fix: remove esc(strip_tags()) from RouteCollection default setters

Author: gr8man

system/Router/RouteCollection.php

@@ -402,22 +402,21 @@ public function getPlaceholders(): array
 
     public function setDefaultNamespace(string $value): RouteCollectionInterface
     {
-        $this->defaultNamespace = esc(strip_tags($value));
-        $this->defaultNamespace = rtrim($this->defaultNamespace, '\\') . '\\';
+        $this->defaultNamespace = rtrim($value, '\\') . '\\';
 
         return $this;
     }
 
     public function setDefaultController(string $value): RouteCollectionInterface
     {
-        $this->defaultController = esc(strip_tags($value));
+        $this->defaultController = $value;
 
         return $this;
     }
 
     public function setDefaultMethod(string $value): RouteCollectionInterface
     {
-        $this->defaultMethod = esc(strip_tags($value));
+        $this->defaultMethod = $value;
 
         return $this;
     }

tests/system/Router/RouteCollectionTest.php

@@ -272,6 +272,14 @@ public function testSetDefaultControllerStoresIt(): void
         $this->assertSame('godzilla', $routes->getDefaultController());
     }
 
+    public function testSetDefaultControllerPreservesSpecialCharacters(): void
+    {
+        $routes = $this->getCollector();
+        $routes->setDefaultController('Foo&Bar');
+
+        $this->assertSame('Foo&Bar', $routes->getDefaultController());
+    }
+
     public function testSetDefaultMethodStoresIt(): void
     {
         $routes = $this->getCollector();
@@ -280,6 +288,22 @@ public function testSetDefaultMethodStoresIt(): void
         $this->assertSame('biggerBox', $routes->getDefaultMethod());
     }
 
+    public function testSetDefaultMethodPreservesSpecialCharacters(): void
+    {
+        $routes = $this->getCollector();
+        $routes->setDefaultMethod('get&set');
+
+        $this->assertSame('get&set', $routes->getDefaultMethod());
+    }
+
+    public function testSetDefaultNamespacePreservesSpecialCharacters(): void
+    {
+        $routes = $this->getCollector();
+        $routes->setDefaultNamespace('App\Controllers&Services');
+
+        $this->assertSame('App\Controllers&Services\\', $routes->getDefaultNamespace());
+    }
+
     public function testTranslateURIDashesWorks(): void
     {
         $routes = $this->getCollector();

user_guide_src/source/changelogs/v4.7.5.rst

@@ -39,6 +39,7 @@ Bugs Fixed
 - **Helpers:** Fixed a bug where ``get_dir_file_info()`` returned incomplete entries for subdirectories and missing files instead of omitting them.
 - **Honeypot:** Fixed a bug where bot detection returned an HTTP 500 response instead of 403 (Forbidden).
 - **Logger:** Fixed a bug where interpolating a log message with array or non-stringable context values could raise PHP warnings or errors.
+- **Router:** Fixed a bug where ``RouteCollection::setDefaultNamespace()``, ``setDefaultController()``, and ``setDefaultMethod()`` incorrectly applied ``esc(strip_tags())``, which encoded HTML entities in PHP identifiers.
 
 See the repo's
 `CHANGELOG.md <https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md>`_