html_escape does not escape single quote

Hello,

I've noticed today that the html_escape function does not encode single quote contrary to OWASP recommendations.

It raised some security problems in my web application and thus I think it would be better to escape single quote by default. Have I missed something ?

[rafaelfranca]

Please post this kind of issues following these instructions.

http://rubyonrails.org/security

Ok thanks.