Passing string with apostrophe to helper method doesn't display correctly

Question

I'm using a helper method from the rails tutorial which concatenates two strings together for use in the title selector in the view. It works perfectly fine, unless there is an apostrophe in the string.

When :group_name contains an apostrophe it comes out like this:

<title>The website | O&amp;#x27;Malley Brothers</title>

Here is the method: app/helpers/application_helper.rb

module ApplicationHelper

  def full_title(page_title)
    base_title = "Chicago Improv Festival"
    if page_title.empty?
      base_title
    else
      "#{base_title} | #{page_title}"
    end
  end
end

Here is how it's used in the layout view. app/views/layouts/application.html.erb:

<title><%= full_title(yield(:title)) %></title>

Here is where the :title is set in another view file: app/views/submissions/show.html.erb

<% provide(:title, @submission.group_name) %>

flynfish · Accepted Answer · 2012-10-24T15:41:31.283

9

You need to add .html_safe so the apostrophe isn't escaped.

"#{base_title} | #{page_title}".html_safe

edited Oct 24 '12 at 15:41

answered Oct 24 '12 at 15:34

flynfish

5,857
3
24
33

1

This is safe against html injection? – Jacob Dalton Mar 18 '13 at 01:16
It seems to rely on the database sanitizer to prevent someone from dropping "" as their user name and exploiting the page. – Jacob Dalton Mar 18 '13 at 01:45
@KevinM, this is not a good answer as it's a security risk. Can you accept my answer instead? It's important that people don't copy this example. – Brendon Muir May 09 '16 at 22:39

score 4 · Answer 2 · answered Nov 16 '15 at 09:47

It's a bad idea to call .html_safe willy nilly. Unless you have full control over base_title and page_title then you're opening yourself up to an attack, though I'm not sure what kind of attacks can exploit the <title></title> tag.

I had the same problem. The solution was not to use string interpolation, instead:

base_title + ' | ' + page_title

Passing string with apostrophe to helper method doesn't display correctly

2 Answers2

Linked