The most straightforward way of doing what you want is: <%= my_var %>
On Wed, Apr 8, 2009 at 7:31 AM, SpringFlowers AutumnMoon < rails-mailing-l...@andreas-s.net> wrote: > > I wonder on RoR, will there be a need sometimes to pass some data from > Ruby to Javascript? > > 1) var title = ______________ ; > > What is the proper way to do it (fill in the code for ______________ ) > if title can have newline character, or single / double quote or any > weird character. and what's more, what if the title from database can > have <script> tags, so the code need to do cross-site scripting (xss) > prevention, say, if the title needs to be set into a div's innerHTML > later. > > 2) further more, what if we do > > <a href="#" onclick="changeIt(______________); return false;">Click > me</a> > > This case is more complicated, since I think there is a rule that says, > anything inside the attribute's value will first be parsed by the > browser as HTML first, so this is a little trickier than case (1). > > Any standard way in Rails to do it? Thanks. > -- > Posted via http://www.ruby-forum.com/. > > > > --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group. To post to this group, send email to rubyonrails-talk@googlegroups.com To unsubscribe from this group, send email to rubyonrails-talk+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/rubyonrails-talk?hl=en -~----------~----~----~----~------~----~------~--~---
