Add a bunch of fixes to HTML escaping, and a test case for it

[selectricity-live] / app / views / election / edit_candidates.rhtml

diff --git a/app/views/election/edit_candidates.rhtml b/app/views/election/edit_candidates.rhtml
index cc2c16a8a9ebb33225f95609456e9d90f11d2308..99f2f129abd0607b2308d256d52572dc775d6c96 100644 (file)
--- a/app/views/election/edit_candidates.rhtml
+++ b/app/views/election/edit_candidates.rhtml
@@ -16,10 +16,10 @@
 
 <p>Please enter new candidates below.</p>
 
-<%= form_tag( { :action => :add_candidate, :id => @election.id },
-              :multipart => true ) %>
+<% form_tag( { :action => :add_candidate, :id => @election.id },
+              :multipart => true ) do %>
 <%= render :partial => 'candidate_form' %>
 <%= submit_tag "Add Candidate" %>
-<%= end_form_tag %>
+<% end %>
 
 <%= button_to "Done!", :action => 'show', :id => @election %>