Wouldn't that allow for inserting funky stuff in the title itself? I'd say the link_to_modal part should be html_safe - the title itself should be excaped.