Rails 3 replaces & with & in text_field

Question

I'm using Rails 3. When a user submits a form with a text_field and has & entered in it, the form gets validated. When it isn't valid, Rails returns an error, which I then show to the user. But now the & is translated to & . How can I change this behaviour? Thanks.

You want to un-escape the HTML in the error message? That's probably not wise, XSS attacks being what they are. Why would you want to show non-escaped HTML as HTML? — David, Aug 13 '12 at 12:21
It is not in the error message. For example a user enters `'Company & Sons'` as his company name. When he submits the form and gets an error, the text field with his company name then reads `'Company & Sons'`. That is not right, is it? — Snels Nick, Aug 13 '12 at 13:08
Ah, that's different. You are correct, the form contents should not be changed. — David, Aug 13 '12 at 14:06

score 3 · Accepted Answer · answered Aug 13 '12 at 18:05

3

I found the culprit. I was sending my input to a sanitizer method, which replaced all ampersands by &.

answered Aug 13 '12 at 18:05

Snels Nick

925
3
13
25

score 1 · Answer 2 · answered Mar 08 '13 at 01:03

1

Maybe try "risky string".html_safe

answered Mar 08 '13 at 01:03

boulder_ruby

38,457
9
79
100

Rails 3 replaces & with & in text_field

2 Answers2