If you try to update a bug with a "&" char in the category this category will not be selected (it should be <option value="" selected="selected"></option>). You can fix this by change the function
function check_selected( $p_var, $p_val=true ) {
if ( $p_var == $p_val ) {
echo ' selected="selected" ';
}
}
to
function check_selected( $p_var, $p_val=true ) {
if ( htmlspecialchars($p_var) == $p_val ) {
echo ' selected="selected" ';
}
}
. You can find this function in core/helper_api.php (Mantis 0.18.0a4). As the chars in $p_val are already escaped you just have to escape $p_var.