如何对html输出做编码转义,如何对字符串进行HTML编码/转义？有内置的吗？

h() is also useful for escaping quotes.

For example, I have a view that generates a link using a text field result[r].thtitle. The text could include single quotes. If I didn't escape result[r].thtitle in the confirm method, the Javascript would break:

<%= link_to_remote "#{result[r].thtitle}", :url=>{ :controller=>:resource,

:action =>:delete_resourced,

:id => result[r].id,

:th => thread,

:html =>{:title=> "<= Remove"},

:confirm => h("#{result[r].thtitle} will be removed"),

:method => :delete %>

<a href="#" οnclick="if (confirm('docs: add column &apos;dummy&apos; will be removed')) { new Ajax.Request('/resource/delete_resourced/837?owner=386&th=511', {asynchronous:true, evalScripts:true, method:'delete', parameters:'authenticity_token=' + encodeURIComponent('ou812')}); }; return false;" title="<= Remove">docs: add column 'dummy'

Note: the :html title declaration is magically escaped by Rails.