Encode/escape HTML string in Ruby on Rails

Question

I have a string that came from a field in my model.

# <br />
"This is my title with break &lt;br /&gt; in the middle"

I'm rendering it on my view:

<p>
  <%= raw @model.title %>
</p>

Which outputs something like this:

<p>
  This is my title with break <br /> in the middle
</p>

However, the <br /> shows up as string and not as html. Any ideas?

Thanks!

Un-escape it, then use html_safe. Enjoy the scripting attacks. — Dave Newton
– Dave Newton, Commented Nov 27, 2013 at 4:11

Justin Vu · Accepted Answer · 2013-11-27 04:49:27Z

4

Yes, as Dave Newton said, you should unescape then use html_safe. If your html in your model is not complex, you could use CGI.unescapeHTML to unescape. But if it is, I think you should use gem HTMLEntities at http://htmlentities.rubyforge.org/

<p>
  <%= (CGI.unescapeHTML @model.title).html_safe %>
</p>

answered Nov 27, 2013 at 4:49

Justin Vu

1616 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Encode/escape HTML string in Ruby on Rails

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related