<p>I am working on a rails project. Using the tag observe_field, I am taking text typed into a text area, processing it in a control, and displaying the result in a div (very similar to the preview in stack overflow). Everything works fine until I type certain special chars.</p>

<ol>
<li>? => causes the variable not to be found in the params object</li>
<li>(pound) => causes an invalid authenticity error</li>
<li>% => stops the div from being updated</li>
<li>&amp; => every thing after the &amp; is no longer passed into the variable on the server. </li>
</ol>

<p>Is there a way to solve this?</p>

<p>--- code sample ---</p>

<p>this is the view. ( 'postbody' is a text area)</p>

<pre><code>&lt;%= observe_field 'postbody', 
                    :update =&gt; 'preview', 
                    :url =&gt; {:controller =&gt; 'blog', :action =&gt; 'textile_to_html'},
                    :frequency =&gt; 0.5,
                    :with =&gt; 'postbody' -%&gt;
</code></pre>

<p>this is the controller that is called</p>

<pre><code>def textile_to_html
    text = params['postbody']
    if text == nil then 
        @textile_to_html = '&lt;br/&gt;never set'
    else 
        r = RedCloth.new text
        @textile_to_html = r.to_html
    end 
    render :layout =&gt; false 
end 
</code></pre>

<p>and this is the javascript that is created:</p>

<pre><code>new Form.Element.Observer('postbody', 0.5, function(element, value) {new Ajax.Updater('preview', '/blog/textile_to_html', {asynchronous:true, evalScripts:true, parameters:'postbody=' + value + '&amp;authenticity_token=' + encodeURIComponent('22f7ee12eac9efd418caa0fe76ae9e862025ef97')})})
</code></pre>

[{'answer_id': 31448, 'author': 'Orion Edwards', 'author_id': 234, 'author_profile': 'https://Stackoverflow.com/users/234', 'pm_score': 0, 'selected': False, 'text': '<p>Can you provide a code sample?</p>\n\n<p>More likely than not you\'ll just need to escape your HTML entities using <a href="http://www.w3schools.com/jsref/jsref_encodeURI.asp" rel="nofollow noreferrer">encodeuri</a> or something like that.</p>\n'}, {'answer_id': 37533, 'author': 'nikz', 'author_id': 3977, 'author_profile': 'https://Stackoverflow.com/users/3977', 'pm_score': 0, 'selected': False, 'text': "<p>What does the generated Javascript look like?</p>\n\n<p>Sounds (at first glance) like it's not being escaped.</p>\n"}, {'answer_id': 287822, 'author': 'waldo', 'author_id': 4870, 'author_profile': 'https://Stackoverflow.com/users/4870', 'pm_score': 3, 'selected': True, 'text': '<p>This is an escaping issue (as stated by others).</p>\n\n<p>You\'ll want to change your observe_field :with statement to something like:</p>\n\n<pre><code>  :with =&gt; "\'postbody=\' + encodeURIComponent(value)"\n</code></pre>\n\n<p>Then in your controller:</p>\n\n<pre><code>def textile_to_html\n  text = URI.unescape(params[\'postbody\'])\n  ...\n</code></pre>\n'}]
['https://Stackoverflow.com/questions/31312', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1632/']