Forcing HTML Escaping in Rails 3

Question

I'm running into an issue with the rails auto-escaping. It currently thinks a string is html_safe (which it is), but for display purposes I need it to still escape the html. Here's the steps the string is taking. ``` my_string = render(:partial => "set_string", :locals => {:item => @item}) <%= my_string %> ``` and the partial is basically ```

Page Header

<%= item.name %> <%= item.body %> etc ``` My understanding is that because I'm displaying text in a view directly (the h2, etc) it assumes it is safe, and it also properly escapes the item outputs, which makes the whole my_string safe. So, when I try to display it with the ``` <%= my_string %> ``` It doesn't escape the remaining html. I tried adding h to force the escaping but that didn't work. So my question is, is there anyway to force html escaping of a safe string other than calling something on the string that will make it unsafe? Thanks a lot for your help.

Accepted Answer

Thanks to Sebastien for the suggestion, I wanted to get the real answer here and not buried in the comments:

I looks like this works:

```
<%= raw CGI::escapeHTML(my_string) %>
```

You need the "raw" call otherwise the escapeHTML makes the string unsafe in addition to escaping it so the auto escape double escapes it.

Forcing HTML Escaping in Rails 3

Solution

Problem