From: Nobuyoshi Nakada <nobu@...>
Date: 2008-09-28T05:32:59+09:00
Subject: Re: h() or html_escape() not escape the single quote... risky?

Hi,

At Sun, 28 Sep 2008 04:28:45 +0900,
SpringFlowers AutumnMoon wrote in [ruby-talk:316193]:
> the single quote is not converted...

I guess that is because the character entity reference of
single quote isn't defined in HTML.

> we usually use double quote but sometimes we use single quote like
> somebody can write
> 
> puts "<input type='hidden' value='" + h(user_comment %> + "'>"
> 

You can use other delimiters than double quote and single quote.

  puts %[<input type="hidden" value="#{h(user_comment)}">]

or heredoc.

  puts <<HIDDEN
<input type="hidden" value="#{h(user_comment)}">
HIDDEN

Heredocs include the last newline, but no differences to use
with #puts.

-- 
Nobu Nakada