Rails: html_escape isn't working

Question

Hi

For some reason html escaping isn't working in my Rails application. Even if I write something like

<%=h '©äö' %>

it isn't converting any of the characters to HTML entities.

I have no clue what the could be. It worked always fine and now just suddenly it don't.

Any ideas?

Answer 1

ö and ä are valid characters in HTML. There is no need to escape them, even if there are HTML entities for them. These entities are convenience, not necessity - as long as the declared encoding (HTTP headers) and the actual character encoding matches, there is no problem if they occur literally.

The only characters that always must be escaped are <, >, & and ", like in XML.

Answer 2

I would say that h only replaces the HTML special characters <, >, & and ". Please have a look on documentation of Rails's ERB::Util.html_escape which is behind the h function.

Answer 3

Google sitemap requires fully escaped URLs, so in this case you need to escape all special and international characters.

This htmlentities library does that for you.

I even wrote a little wrapper in the application_helper.rb:

def html_entity_escape(s)
  require 'htmlentities'
  @html_coder ||= HTMLEntities.new
  @html_coder.encode(s)
end