# Why does text\_field not html\_escape properly?

**URL:** <https://www.ruby-forum.com/t/why-does-text-field-not-html-escape-properly/90469>\
**Category:** Rails\
**Created:** [March 29, 2007, 1:07am UTC](https://www.ruby-forum.com/t/why-does-text-field-not-html-escape-properly/90469 "2007-03-29T01:07:49Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![xavier](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/x/2bfe46/32.png) [@xavier](https://www.ruby-forum.com/u/xavier)\
**Post date:** [March 29, 2007, 1:07am UTC](https://www.ruby-forum.com/t/why-does-text-field-not-html-escape-properly/90469/1 "2007-03-29T01:07:49Z")

</div>

Can someone fill me in on the rationale for using escape\_once over  
html\_escape for the text\_field helper?

To me, if I have “& \>” stored in my DB, it makes sense that that is  
the value that should be displayed in a text\_field. To do this, it  
should be escaped to give:  
\<input … value="& &gt;" /\>

Current behaviour is:  
\<input … value="& \>" /\>

Relevant code is in actionpack/lib/action\_view/helpers/tag\_helper.rb

A test to add to actionpack/test/template/form\_tag\_helper\_test.rb  
(currently fails)

def test\_text\_field\_with\_html\_entities\_in\_value  
@post.title = “& \>”  
assert\_dom\_equal(  
‘’, text\_field(“post”, “title”)  
)  
end

Cheers,  
Xavier