# Text\_area\_tag not escaping content by default

**URL:** <https://www.ruby-forum.com/t/text-area-tag-not-escaping-content-by-default/160392>\
**Category:** Rails\
**Created:** [February 15, 2009, 9:11pm UTC](https://www.ruby-forum.com/t/text-area-tag-not-escaping-content-by-default/160392 "2009-02-15T21:11:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mla](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/b77776/32.png) [@mla](https://www.ruby-forum.com/u/mla)\
**Post date:** [February 15, 2009, 9:11pm UTC](https://www.ruby-forum.com/t/text-area-tag-not-escaping-content-by-default/160392/1 "2009-02-15T21:11:24Z")

</div>

I stumbled on the fact that text\_area\_tag does not HTML escape its  
content by default. For example:

text\_area\_tag “body”, “”

At the very least, are we amendable to adding a note in the  
FormTagHelper docs about the escaping rules?

---

<div class="post-metadata">

**Author:** ![mla](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/b77776/32.png) [@mla](https://www.ruby-forum.com/u/mla)\
**Post date:** [February 19, 2009, 5:38pm UTC](https://www.ruby-forum.com/t/text-area-tag-not-escaping-content-by-default/160392/2 "2009-02-19T17:38:12Z")

</div>

On Feb 15, 8:10 pm, mla [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I found a ticket on this issue from a couple years ago from Chris M.  
> but it looks like it was dropped:[http://dev.rubyonrails.org/ticket/5929](http://dev.rubyonrails.org/ticket/5929)

I’ve put up an updated ticket and patch:

[http://rails.lighthouseapp.com:80/projects/8994/tickets/2015-text\_area\_tag-should-escape-contents-by-default](http://rails.lighthouseapp.com:80/projects/8994/tickets/2015-text_area_tag-should-escape-contents-by-default)

Since making that first patch two years ago, the corresponding  
text\_area method in FormHelper now escapes its contents by default, so  
I think there’s a good case for text\_area\_tag having the same  
behaviour, for consistency’s sake if nothing else.

Chris

---

<div class="post-metadata">

**Author:** ![mla](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/b77776/32.png) [@mla](https://www.ruby-forum.com/u/mla)\
**Post date:** [February 19, 2009, 5:38pm UTC](https://www.ruby-forum.com/t/text-area-tag-not-escaping-content-by-default/160392/3 "2009-02-19T17:38:48Z")

</div>

On Feb 15, 8:10 pm, mla [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I found a ticket on this issue from a couple years ago from Chris M.  
> but it looks like it was dropped:[http://dev.rubyonrails.org/ticket/5929](http://dev.rubyonrails.org/ticket/5929)

I’ve posted a new ticket on Lighthouse with an up-to-date patch:

[http://rails.lighthouseapp.com/projects/8994-ruby-on-rails/tickets/2015-text\_area\_tag-should-escape-contents-by-default](http://rails.lighthouseapp.com/projects/8994-ruby-on-rails/tickets/2015-text_area_tag-should-escape-contents-by-default)

I also noticed that the text\_area method in FormHelper actually does  
escape its contents now, so text\_area\_tag probably should do the same  
for consistency’s sake if nothing else.

Chris