This should not be set via params.
A loan is definitely required.
This is not html_safe.
Don't store HTML entities in the database.