diff --git a/actionview/lib/action_view/helpers/form_tag_helper.rb b/actionview/lib/action_view/helpers/form_tag_helper.rb
index 88b8400644af8..7a7ddaa41c8ca 100644
--- a/actionview/lib/action_view/helpers/form_tag_helper.rb
+++ b/actionview/lib/action_view/helpers/form_tag_helper.rb
@@ -794,9 +794,11 @@ def range_field_tag(name, value = nil, options = {})
end
# Creates the hidden UTF8 enforcer tag. Override this method in a helper
- # to customize the tag.
+ # to customize the tag. Note that we have the HTML written out
+ # explicitly here to avoid potential problems with including a
+ # unicode character in output.
def utf8_enforcer_tag
- tag(:input, :type => "hidden", :name => "utf8", :value => "✓".html_safe)
+ %{}.html_safe
end
private
diff --git a/actionview/lib/action_view/helpers/tags/text_field.rb b/actionview/lib/action_view/helpers/tags/text_field.rb
index e910879ebf8db..e0b80d81c2c0a 100644
--- a/actionview/lib/action_view/helpers/tags/text_field.rb
+++ b/actionview/lib/action_view/helpers/tags/text_field.rb
@@ -7,7 +7,6 @@ def render
options["size"] = options["maxlength"] unless options.key?("size")
options["type"] ||= field_type
options["value"] = options.fetch("value") { value_before_type_cast(object) } unless field_type == "file"
- options["value"] &&= ERB::Util.html_escape(options["value"])
add_default_name_and_id(options)
tag("input", options)
end
diff --git a/actionview/lib/action_view/helpers/url_helper.rb b/actionview/lib/action_view/helpers/url_helper.rb
index 9a9777317a100..c3be47133c58a 100644
--- a/actionview/lib/action_view/helpers/url_helper.rb
+++ b/actionview/lib/action_view/helpers/url_helper.rb
@@ -462,8 +462,6 @@ def link_to_if(condition, name, options = {}, html_options = {}, &block)
# Email me: me@domain.com
#
def mail_to(email_address, name = nil, html_options = {}, &block)
- email_address = ERB::Util.unwrapped_html_escape(email_address)
-
html_options, name = name, nil if block_given?
html_options = (html_options || {}).stringify_keys
@@ -471,11 +469,11 @@ def mail_to(email_address, name = nil, html_options = {}, &block)
option = html_options.delete(item) || next
"#{item}=#{Rack::Utils.escape_path(option)}"
}.compact
- extras = extras.empty? ? '' : '?' + ERB::Util.unwrapped_html_escape(extras.join('&'))
+ extras = extras.empty? ? '' : '?' + extras.join('&')
- html_options["href"] = "mailto:#{email_address}#{extras}".html_safe
+ html_options["href"] = "mailto:#{email_address}#{extras}"
- content_tag(:a, name || email_address.html_safe, html_options, &block)
+ content_tag(:a, name || email_address, html_options, &block)
end
# True if the current request URI was generated by the given +options+.