# Proper escaping

**URL:** <https://www.ruby-forum.com/t/proper-escaping/49820>\
**Category:** Rails\
**Created:** [December 8, 2005, 11:08pm UTC](https://www.ruby-forum.com/t/proper-escaping/49820 "2005-12-08T23:08:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![parker](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/c6cbf5/32.png) [@parker](https://www.ruby-forum.com/u/parker)\
**Post date:** [December 8, 2005, 11:08pm UTC](https://www.ruby-forum.com/t/proper-escaping/49820/1 "2005-12-08T23:08:19Z")

</div>

Hello all,

I have a tricky issue with escape\_javascript and render/render\_to\_string  
I’m looking for some comments on. Brief background, I’m making a gmaps  
interface and am trying to render a partial to a string in my controller  
so I can pass it through to my maps object (a library) for handling.

To make this work I need to escape the text returned by the template.  
However, I can’t do this right before passing it to the object, since  
escape\_javascript is only available in the view.

My next thought was to define a container template that did nothing but  
escape the content, e.g.:

\<%= escape\_javascript render\_to\_string :partial =\> ‘inner\_template’ %\>

The problem with this is that render\_to\_string is only available to the  
controller. So, I can’t escape after the fact, or render a string in  
the  
template, where I could escape it.

Anyone solved this short of re-implementing escape\_javascript and making  
that available to the controller?

Thanks as always for the help,

## pt.

Parker T.  
Professional  
(w) [http://placesite.com](http://placesite.com)  
(c) 510.541.0125

---

<div class="post-metadata">

**Author:** ![parker](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/c6cbf5/32.png) [@parker](https://www.ruby-forum.com/u/parker)\
**Post date:** [December 9, 2005, 6:23am UTC](https://www.ruby-forum.com/t/proper-escaping/49820/2 "2005-12-09T06:23:21Z")

</div>

Parker T. wrote:

> escape\_javascript is only available in the view.  
> Anyone solved this short of re-implementing escape\_javascript and  
> making that available to the controller?
> 
> Thanks as always for the help,

You can invoke anny helper function through the @template instance  
variable in the controller. So you’d write:

escaped\_js = @template.escape\_javascript(render\_to\_string(:partial =\>  
‘inner\_template’))

HTH,

– stefan

[http://railsexpress.de/blog](http://railsexpress.de/blog)

---

<div class="post-metadata">

**Author:** ![parker](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/c6cbf5/32.png) [@parker](https://www.ruby-forum.com/u/parker)\
**Post date:** [December 9, 2005, 6:27pm UTC](https://www.ruby-forum.com/t/proper-escaping/49820/3 "2005-12-09T18:27:30Z")

</div>

On 12/8/05, Stefan K. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> You can invoke anny helper function through the @template instance  
> variable in the controller. So you’d write:
> 
> escaped\_js = @template.escape\_javascript(render\_to\_string(:partial =\>  
> ‘inner\_template’))

Ah very interesting, thanks. And now for the follow-up…

What I’m trying to do is link\_to remote and fetch some information  
(profile), along with a form(comment form) that itself uses a  
form\_remote tag to submit. The form is fetched and _looks_ properly  
escaped, but when I try to submit I get js errors in firefox (included  
below), though not in safari. In both cases though, clicking ‘submit’  
uses a normal post rather than making an xmlhttp request.

I could work around this by pre-including a form and using my data  
fetch to return some js that would fill some hidden fields (to  
associate the profile with the comment), but that’s a poor work  
around. I could see wanting to do this same thing, but return a form  
with edit-in-place fields, which could not be worked around.

the gory details:

js error in firefox on submitting comment form:

Error: missing ) after argument list  
Source Code:  
g:function(request){$(‘mapped\_place\_add\_comment\_link’).value =  
‘Adding…’; $(‘mapped\_place\_comment\_link’.disabled = true;},  
parameters:Form.serialize(this)}); return false;

js returned by the server to generate profile, including comment form:

$(‘map\_current\_place\_profile’).innerHTML = '\n\<div  
id="profile\_container"\>\n\n \<div class="sectionHeader"\>\n  
gghhjjkjk\n \n\n \<div id="profileBody"\>\n sdfgghhh\n

\n\n\n\n
Comments
\n
\n\n
\n\n
\n \n \n 
\n \n\n \n\n\n

Title\n

\n\n

Body\n

\n\n\n\n \n\n \n \n \n \n 
\n\n
\n\n\n';

Thanks,

## pt.

Parker T.

> **[ParkErt.com is for sale | HugeDomains](https://www.hugedomains.com/domain_profile.cfm?d=parkert.com)**
>
> Join thousands of people who own a premium domain. Affordable financing available.

510.541.0125