use c_toy local var instead of @c_toy instance var
escape js, use id selector instead of class selector
Merge pull request #1 from johnlinvc/use_right_var_and_escape

make ajax works