title: Why is an apostrophe appearing as &#x27; in Ruby on Rails and is this a sign of a security issue?
body: <p>I'm new to Ruby on Rails and I'm using a form_helper to create and update records. In the form below, I'm collecting information to save data for maps that users can create. The :name field is the name that user gives to a map. It's saved to a MySQL table into a field that is varchar(255). </p>
  
  <p>If I name a map "John's Map", it appears in both the database and in the view as </p>
  
  <pre><code>    John&amp;#x27;s Map 
  </code></pre>
  
  <p>How can I prevent this from happening, and is my code susceptible to SQL injection with this approach? </p>
  
  <p>I've seen some responses related to Python and PHP, but I wasn't sure about Rails. I'm using Virtualmin to create tables, so any responses that let me address the issue within Virtualmin would be much appreciated. Thanks!</p>
  
  <p><strong>From View</strong></p>
  
  <pre><code>    &lt;% form_for @newsavedmap, :html=&gt;{:id=&gt;'createaMap'} do |f| %&gt;
      &lt;%= f.error_messages %&gt;
  
      &lt;% if params[:newsavedmap_id] %&gt;
  &lt;%= f.text_field :name, {:id=&gt;"savemap_name", :size=&gt;30, :value=&gt; @newsavedmap.name }%&gt;&lt;/p&gt;
      &lt;% else %&gt;
  &lt;%= f.text_field :name, {:id=&gt;"savemap_name", :size=&gt;30, :value=&gt;"New Map"}%&gt;&lt;/p&gt;
      &lt;% end %&gt;
  </code></pre>
  
  <p><strong>Database Table Details</strong></p>
  
  <pre><code>    DROP TABLE IF EXISTS `newsavedmaps`;
      /*!40101 SET @saved_cs_client     = @@character_set_client */;
      /*!40101 SET character_set_client = utf8 */;
      CREATE TABLE `newsavedmaps` (
      FIELDSAREALLLISTEDHERE
      `name` varchar(255) DEFAULT NULL,
      ) ENGINE=InnoDB AUTO_INCREMENT=159 DEFAULT CHARSET=utf8;
      /*!40101 SET character_set_client = @saved_cs_client */;
  </code></pre>
  
  <p>Other tables in the database display the apostrophe. For example, I have another form that looks like the below, and when a user enters a name with an apostrophe, the apostrophe appears as an apostrophe in the table.</p>
  
  <pre><code>    &lt;form id="createitem" action="/saveditems" method="post"&gt;
      &lt;label for="saveditem_name"&gt;Item Title&lt;/label&gt;
      &lt;%= text_field :saveditem, :name %&gt;
  </code></pre>
  
  <p>That table's structure:</p>
  
  <pre><code>    DROP TABLE IF EXISTS `saveditems`;
      /*!40101 SET @saved_cs_client     = @@character_set_client */;
      /*!40101 SET character_set_client = utf8 */;
      CREATE TABLE `saveditems` (
      FIELDSAREALLLISTEDHERE
      `name` varchar(255) NOT NULL, 
      ) ENGINE=MyISAM AUTO_INCREMENT=8418 DEFAULT CHARSET=latin1;
      /*!40101 SET character_set_client = @saved_cs_client */;
  </code></pre>
  
  <p><strong>Edit 1</strong></p>
  
  <p>I used ALTER TABLE newsavedmaps CONVERT TO CHARACTER SET latin1; and my newsavedmaps table now looks like this:</p>
  
  <pre><code>    DROP TABLE IF EXISTS `newsavedmaps`;
      /*!40101 SET @saved_cs_client     = @@character_set_client */;
      /*!40101 SET character_set_client = utf8 */;
      CREATE TABLE `newsavedmaps` (
      FIELDS ALL LISTED HERE
      ) ENGINE=InnoDB AUTO_INCREMENT=248 DEFAULT CHARSET=latin1;
      /*!40101 SET character_set_client = @saved_cs_client */;
  </code></pre>
  
  <p>The apostrophes now appear correctly in the database, but they still show up in the view as strange characters. Any ideas? Could this have anything to do with this: <a href="https://github.com/rails/rails/issues/9108" rel="nofollow">https://github.com/rails/rails/issues/9108</a></p>