Views, forms and assets interview questions

The plain output tag escapes, unless the value it prints is already marked as HTML-safe, so an ampersand, a quote and the angle brackets reach the page as character references and a typed script element is shown as text. Three ways skip it. The raw helper prints the value unchanged, and is only a call to html_safe written differently. The double-equals tag is the same thing in tag form, which makes it easy to misread as the ordinary one. And calling html_safe marks the string itself, so every later output tag prints it as it is, however far from the template that marking happened. For a field that is meant to carry markup, sanitize checks it against an allowlist of tags and attributes and marks only the result.

Turbo picks its behaviour from the response status. A 2xx is a successful navigation, so Turbo follows it and the re-rendered form with its errors is not swapped into the page. A 4xx or 5xx tells Turbo the submission failed, so it replaces the form in place, keeping the errors and what the user typed. Status 422 Unprocessable Content means the request was understood but its values could not be processed, which is exactly a validation failure. A successful change uses redirect with 303 for the same reason, so Turbo follows it as a navigation. In Rails 8.1 the symbol is :unprocessable_content.

A browser sends a checkbox's value only when it is ticked and nothing when it is not, so without help the controller could not tell an unticked box from a field that was never submitted. f.check_box writes a hidden input valued 0 just before the box, which is valued 1. When the box is unticked only the hidden 0 is sent; when it is ticked both are sent and the later checkbox value 1 wins. So the parameter is always present, 0 or 1, and the model can store a real boolean rather than guess from a missing key.