Backport of fix from #5173 - fixes #7252

Rather than use the MySQL specific TINYTEXT, MEDIUMTEXT and LONGTEXT
datatypes, Active Record migrations use TEXT(n) where n is the limit
specified by the developer. Unfortunately how MySQL interprets n
depends on the column's encoding so any limit above 5592405 will be
interpreted as a LONGTEXT when the encoding is UTF-8.

This commit fixes this by interpreting the limit within the adapter
and using the specific MySQL datatype as appropriate.
html_escape should escape single quotes

https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content
Closes #7215

Conflicts:
	actionpack/test/controller/new_base/render_template_test.rb
	actionpack/test/template/asset_tag_helper_test.rb
	actionpack/test/template/erb_util_test.rb
	actionpack/test/template/javascript_helper_test.rb
	actionpack/test/template/template_test.rb
	activesupport/lib/active_support/core_ext/string/output_safety.rb
	activesupport/test/core_ext/string_ext_test.rb
	railties/test/application/assets_test.rb
Fix tests about single quote escaping
escape select_tag :prompt values

CVE-2012-3463
Do not mark strip_tags result as html_safe

Thanks to Marek Labos & Nethemba

CVE-2012-3465
Add CHANGELOG entries
Bump to 3.0.17
Add html_escape note to CHANGELOG
Merge pull request #7308 from amerine/3-0-stable

Add html_escape note to CHANGELOG
Remove warning when using html_escape with Ruby 1.9.

Closes #7430
updating changelogs
CVE-2012-5664 options hashes should only be extracted if there are extra parameters
bumping to 3.0.18
* Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * dealing with empty hashes. Thanks Damien Mathieu

Conflicts:
	actionpack/CHANGELOG.md
	activerecord/CHANGELOG.md

Conflicts:
	actionpack/CHANGELOG.md
	activerecord/CHANGELOG.md
	activerecord/lib/active_record/relation/predicate_builder.rb
CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
bumping version
Remove test for XML YAML parsing

The support for YAML parsing in XML has been removed from Active Support
since it introduced an security risk. See a494824 for more detail.
Merge pull request #8836 from sikachu/3-0-stable-fix-ars

Remove test for XML YAML parsing
Methods that return nil should not be considered YAML

This is a direct port of @jaw6's pull request
https://github.com/rails/rails/pull/492. His cleanly applied to Rails
v3.1 and v3.2, and this cleanly applies to v3.0.

With yesterday's security patches
http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/
there is now an issue with Rails v3.0 serving XML to any of the latest
versions of ActiveResource.

Without this, Rails v3.0 can serve XML to ActiveResource consumers that
will see `Hash::DisallowedType: Disallowed type attribute: "yaml"`
Merge pull request #8853 from zmoazeni/3-0-xml-serialization-fix

Methods that return nil should not be considered YAML