ember.js - How to stop Ember.Handlebars.Utils.escapeExpression escaping apostrophes -

i'm new ember, i'm on v1.12 , struggling following problem.

• i'm making template helper
• the helper takes bodies of tweets , html anchors around hashtags , usernames.

the paradigm i'm following is:

1. use ember.handlebars.utils.escapeexpression(value); escape input text
2. do logic
3. use ember.handlebars.safestring(value);

however, 1. seems escape apostrophes. means sentences pass escaped characters. how can avoid whilst making sure i'm not introducing potential vulnerabilities?

edit: example code

export default ember.handlebars.makeboundhelper(function(value){   // make sure we're safe kids.   value = ember.handlebars.utils.escapeexpression(value);   value = addurls(value);   return new ember.handlebars.safestring(value); }); 

where addurlsis function uses regex find , replace hashtags or usernames. example, if given #emberjs foo return <a href="blah">#emberjs</a> foo.

the result of above helper function displayed in ember (htmlbars) template.

escapeexpression designed convert string representation which, when inserted in dom, escape sequences translated browser, result in original string. so

"1 < 2" 

is converted into

"1 < 2" 

which when inserted dom displayed

1 < 2 

if "1 < 2" inserted directly dom (eg innerhtml), cause quite bit of trouble, because browser interpret < beginning of tag.

so escapeexpression converts ampersands, less signs, greater signs, straight single quotes, straight double quotes, , backticks. conversion of quotes not necessary text nodes, attribute values, since may enclosed in either single or double quotes while containing such quotes.

here's list used:

var escape = {   "&": "&amp;",   "<": "&lt;",   ">": "&gt;",   '"': "&quot;",   "'": "&#x27;",   "`": "&#x60;" }; 

i don't understand why escaping of quotes should causing problem. presumably you're doing escapeexpression because want characters such < displayed when output template using normal double-stashes {{}}. precisely same thing applies quotes. may escaped, when string displayed, should display fine.

perhaps can provide more information input , desired output, , how "printing" strings , in contexts seeing escaped quote marks when don't want to.