number_to_phone always return safe

2 files changed, 3 insertions, 5 deletions

diff --git a/actionpack/lib/action_view/helpers/number_helper.rb b/actionpack/lib/action_view/helpers/number_helper.rb
index d1c8064c1b..15f032b3d6 100644
--- a/actionpack/lib/action_view/helpers/number_helper.rb
+++ b/actionpack/lib/action_view/helpers/number_helper.rb
@@ -51,12 +51,9 @@ module ActionView
 
         begin
           Float(number)
-          is_number_html_safe = true
         rescue ArgumentError, TypeError
           if options[:raise]
             raise InvalidNumberError, number
-          else
-            is_number_html_safe = number.to_s.html_safe?
           end
         end
 
@@ -76,7 +73,7 @@ module ActionView
           number.starts_with?('-') ? number.slice!(1..-1) : number
         end
         str << " x #{extension}" unless extension.blank?
-        is_number_html_safe ? str.html_safe : str
+        html_escape(str)
       end
 
       # Formats a +number+ into a currency string (e.g., $13.65). You can customize the format
diff --git a/actionpack/test/template/number_helper_test.rb b/actionpack/test/template/number_helper_test.rb
index c14dfb250f..dcdf28ddd5 100644
--- a/actionpack/test/template/number_helper_test.rb
+++ b/actionpack/test/template/number_helper_test.rb
@@ -289,7 +289,8 @@ class NumberHelperTest < ActionView::TestCase
     assert number_to_percentage("asdf".html_safe).html_safe?
 
     assert number_to_phone(1).html_safe?
-    assert !number_to_phone("<script></script>").html_safe?
+    assert_equal "&lt;script&gt;&lt;/script&gt;", number_to_phone("<script></script>")
+    assert number_to_phone("<script></script>").html_safe?
     assert number_to_phone("asdf".html_safe).html_safe?
 
     assert number_with_delimiter(1).html_safe?