8

In my layout I have

<% @current_user.popups.each do |p| %>
  <% content_for :script do %>
    <%= "$(document).ready ( function() { $.jGrowl(\"#{p.message}\", { sticky: true }) });" %>
  <% end %>
<% end %>

And then in the script section I have

<%= yield :script %>

The problem is that this renders the escaped quotes as \&quot; and javascript doesn't like this.

How can I stop this from happening? Or is there another approach to this? I can't use single quotes because I'd like to have some html in the message. I'd appreciate any help.

James
  • 5,273
  • 10
  • 51
  • 76

2 Answers2

12

Are you using Rails 3? In Rails 3 html escaping is done by default and you must bypass it each time like the following: jdl had the right idea above, but it sounds like you still have issues.

<% content_for :script do %>
  $(document).ready ( function() { $.jGrowl("<%= raw(p.message) %>", { sticky: true }) });
<% end %>

But even better would be to run it through the helper provided by rails: escape_javascript so escape carriage returns and quotes

like this:

$(document).ready ( function() { $.jGrowl("<%= raw(escape_javascript(p.message)) %>", { sticky: true }) });
Daniel Beardsley
  • 19,907
  • 21
  • 66
  • 79
1

try adding .html_safe to your string in the view.

<%= "$(document).ready ( function() { $.jGrowl(\"#{p.message.html_safe}\", { sticky: true }) });" %>
Eskim0
  • 775
  • 7
  • 17