rails/prototype-rails — pull request #18 by SpiffyStores (2013-01-11 03:09:07+00:00)
Title: Generated page_update javascript is incorrectly escaped.

update_page fragments are marked as html_safe even though they have not been html_escaped. When a fragment is passed as an html tag option, the standard html_escape is bypassed because of the html_safe flag. This leaves quotes (") unescaped, causing HTML errors.