From: "Andreas S." <x-ruby-forum.com@...>
Date: 2008-09-28T05:22:47+09:00
Subject: Re: h() or html_escape() not escape the single quote... risky?

This is a Rails question. Please ask Rails questions in a Rails forum, 
not on the Ruby mailing list.

SpringFlowers AutumnMoon wrote:
> the single quote is not converted...
> 
> I just wonder sometimes we happen to write code such as
> 
> <input type='hidden' value='<%= h(user_comment %>'>

Just don't, it's not correct HTML.
-- 
Posted via http://www.ruby-forum.com/.