text_field helper escaping html_safe content in options hash

Forgot to format code - revised below:

I am trying to add a data-attribute to a text_field by including it in the options hash:

<%= f.text_field(:foo, "data-bar" => "<script>") %>

rails is outputting:

<input data-bar="&lt;script&gt;"

instead of

<input data-bar="<script>"

even tried making entire helper html_safe, which didn't work either:

<%= f.text_field(:foo, "data-bar" => "<script>").html_safe %>

Can you please try the following and see if it works?

  <%= f.text_field(:foo, "data-bar" => "<script>".html_safe) %>

If it does work please update the ticket.

oops my original ticket should read what you have:

<%= f.text_field(:foo, "data-bar" => "<script>".html_safe) %>

that won't work given the current implementation, however we can probably fix it.

However before we prioritise it I'm intrigued, what's your actual use case here?

Thanks Michael,

The "script" was the simplest example I could think of that didn't work, although it probably doesn't make a lot of sense as a practical exercise.

The real scenario is this - I'm using multiple jquery autosuggests (http://code.drewwilson.com/entry/autosuggest-jquery-plugin) on a single page that take json objects strings as "preFill" data, so wanted to put json strings in an html data- attribute instead of having to output each object individually in a JS call attached to a single autosuggest. Doing a model.to_json.html_safe still escapes my string.

The escaping is what you want though, if your json strings are in that attribute it will parse the HTML incorrectly. A single raw " or > in your attribute and your whole document will be messed up.

if the attribute contains " or < then your javascript code will see it as the decoded characters.

ipster, in light of Michael's comment, please update the ticket if it can be closed.

The plugin doesn't seem to be able to handle escaped data, even when not within an attribute. I know this may be outside the scope of rails, but have any ideas why? doing an html_safe works.

Automatic cleanup of spam.

louis vuitton watches