Rails render raw html but escape javascript?

Question

So I have some user generated content areas of my site. I want them to be able to use html for markup purposes, but I don't want them to be able to execute any arbitrary javascript.

From my understanding raw() will just output everything, html, javascript, and all right into the webpage.

Is there a method that will allow raw rendering of html but not allow rendering of javascript?

You're looking for an HTML sanitizer.

user229044
– user229044 ♦

2011-08-10 06:28:50 +00:00
Commented Aug 10, 2011 at 6:28 — user229044
– user229044 ♦, Commented Aug 10, 2011 at 6:28

Behrang Saeedzadeh · Accepted Answer · 2011-08-10 06:26:11Z

1

Have a look at sanitize.

answered Aug 10, 2011 at 6:26

Behrang Saeedzadeh

48.2k27 gold badges126 silver badges168 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Rails render raw html but escape javascript?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related