How to automatically escape HTML in Ruby on Rails?

Question

I'm just getting started with RoR (and web development in general).

I know that when outputting user-supplied data we should escape it with the h() helper.

Is there a way to ensure that all form data (params?) received by an action is guaranteed to be escaped automatically? (I do understand that it's a wise decision to escape HTML when displaying in a view, which I will be doing in any case ).

stephenmurdoch · Accepted Answer · 2010-09-15 06:24:03Z

3

don't know if this is the answer you were looking for, but you can do this by upgrading your app to rails3 - quoting Ryan Bates "In Rails 3, however, output is escaped automatically so there’s no need to put the h method" - read the asciicast or watch the railscast :)

answered Sep 15, 2010 at 6:24

stephenmurdoch

34.7k30 gold badges120 silver badges194 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Zabba Over a year ago

Thanks, that's great news on the "output" front, but I was wondering if it was possible to do the escaping such that even the action would only get HTML-escaped text? (Would love to use Rails 3.0 but there seems to be problems with mysql2 gem that doesn't work with it :( )

Zabba Over a year ago

Seems like there is a plug for this (for RoR 2.3.7+, I believe) called rails_xss. Thanks for your inputs!

Collectives™ on Stack Overflow

How to automatically escape HTML in Ruby on Rails?

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related