diff --git a/actionpack/CHANGELOG b/actionpack/CHANGELOG
index a1173568d8..bd5e99ab16 100644
--- a/actionpack/CHANGELOG
+++ b/actionpack/CHANGELOG
@@ -1,5 +1,7 @@
*SVN*
+* The tag helper may bypass escaping. [Jeremy Kemper]
+
* Cache asset ids. [Jeremy Kemper]
* Optimized named routes respect AbstractRequest.relative_url_root. #9612 [danielmorrison, Jeremy Kemper]
diff --git a/actionpack/lib/action_view/helpers/tag_helper.rb b/actionpack/lib/action_view/helpers/tag_helper.rb
index 963f494760..999cbfb52a 100644
--- a/actionpack/lib/action_view/helpers/tag_helper.rb
+++ b/actionpack/lib/action_view/helpers/tag_helper.rb
@@ -11,9 +11,10 @@ module ActionView
BOOLEAN_ATTRIBUTES = Set.new(%w(disabled readonly multiple))
# Returns an empty HTML tag of type +name+ which by default is XHTML
- # compliant. Setting +open+ to true will create an open tag compatible
+ # compliant. Set +open+ to true to create an open tag compatible
# with HTML 4.0 and below. Add HTML attributes by passing an attributes
- # hash to +options+.
+ # hash to +options+. Set +escape+ to false to disable attribute value
+ # escaping.
#
# ==== Options
# The +options+ hash is used with attributes with no value like (disabled and
@@ -30,16 +31,20 @@ module ActionView
# tag("input", { :type => 'text', :disabled => true })
# # =>
#
- # tag("img", { :src => "open.png" })
- # # =>
- def tag(name, options = nil, open = false)
- "<#{name}#{tag_options(options) if options}" + (open ? ">" : " />")
+ # tag("img", { :src => "open & shut.png" })
+ # # =>
+ #
+ # tag("img", { :src => "open & shut.png" }, false, false)
+ # # =>
+ def tag(name, options = nil, open = false, escape = true)
+ "<#{name}#{tag_options(options, escape) if options}" + (open ? ">" : " />")
end
# Returns an HTML block tag of type +name+ surrounding the +content+. Add
# HTML attributes by passing an attributes hash to +options+.
# Instead of passing the content as an argument, you can also use a block
# in which case, you pass your +options+ as the second parameter.
+ # Set escape to false to disable attribute value escaping.
#
# ==== Options
# The +options+ hash is used with attributes with no value like (disabled and
@@ -58,15 +63,15 @@ module ActionView
# Hello world!
# <% end -%>
# # =>
Hello world!