Ruby on Rails: How best to escape a string in a model?

Posted by williamjones on Stack Overflow See other posts from Stack Overflow or by williamjones
Published on 2010-05-21T03:45:02Z Indexed on 2010/05/21 3:50 UTC
Read the original article Hit count: 256

Filed under:

ruby-on-rails

|

sanitize

|

cross-site-scripting

I want my application to sanitize html on input rather than on display, so that the fields saved into the database are sanitized.

I've been doing this with strip_tags, and it was working great. However, this has the downside that it means the user can't input anything that's bracketed with < and >.

How can I tell Rails in the model to securely escape tags before saving them to the database? I'd like to not have to call h on the sanitized fields again before using them in the views.

© Stack Overflow or respective owner

Related posts about ruby-on-rails

Ruby on Rails - How can I start? [closed]

as seen on Programmers - Search for 'Programmers'
I have misconception in understanding the relationship between Ruby language and Ruby on Rails Framework. Because of 'I am an absolute beginner' in web development I have no idea if I have to grasp the fundamentals of Ruby before I go with Ruby on Rails! I also want to ask who is behind both Ruby… >>> More
DES3 decryption in Ruby on Rails

as seen on Stack Overflow - Search for 'Stack Overflow'
My RoR server receives a string, that was encrypted in C++ application using des3 with base64 encoding The cipher object is created so: cipher = OpenSSL::Cipher::Cipher::new("des3") cipher.key = key_str cipher.iv = iv_str key_str and iv_str: are string representations of key and initialization… >>> More
Ruby on rails: Image downloads with Authentication/Authorization/Time outs

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi Guys, I'm having few doubts on implementing file downloads. I'm creating an app where I use attachment_fu with Amazon s3 to upload files. Things are working pretty well so far on uploading side. Now its the time to start the file downloads. Here is what I need, a logged in user search and browse… >>> More
Ruby on Rails deployment, on "thin" server with lot of attachments

as seen on Stack Overflow - Search for 'Stack Overflow'
A lot of PDFs are stored inside MySQL as a BLOB field for each PDF file. The average file size is 500K each. The Rails app will stream the :binary data as file downloads, where there is a user click on the download link. Assume there is a maximum of 5 users downloading 5 PDFs concurrently, what… >>> More
Apply Behavior Driven Development to Ruby on Rails with Rspec

as seen on Internet.com - Search for 'Internet.com'
Applying the Behavior Driven Development (BDD) methodology to your Rails development takes you beyond traditional Test Driven Development. Learn how to do it with the Ruby-based BDD framework RSpec. >>> More

Related posts about sanitize

Best way to sanitize content with PHP?

as seen on Stack Overflow - Search for 'Stack Overflow'
Which is the best way to "sanitize" content? An example... Example - Before sanitize: Morbi mollis ante vitae massa suscipit a tempus est pellentesque. Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. Nulla mattis iaculis consectetur. Morbi mollis ante… >>> More
NameError: uninitialized constant Nokogiri::HTML::DocumentFragment

as seen on Stack Overflow - Search for 'Stack Overflow'
About three hours ago I started seeing the above error in my production server. It comes from a call to the sanitize gem: vendor/rails/activerecord/lib/../../activesupport/lib/active_support/dependencies.rb:276:in 'load_missing_constant' vendor/rails/activerecord/lib/../../activesupport/lib/active_support/dependencies… >>> More
PHP sandbox/sanitize code passed to create_function

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello, I am using create_function to run some user-code at server end. I am looking for any of these two: Is there a way to sanitize the code passed to it to prevent something harmful from executing? Alternately, is there a way to specify this code to be run in a sandboxed environment so that… >>> More
Sanitize a string with non-alphanum repetition

as seen on Stack Overflow - Search for 'Stack Overflow'
I need to sanitize article titles when (creative) users try to "attract attention" with some non-alphanum repetition. Exemples: Buy my product !!!!!!!!!!!!!!!!!!!!!!!! Buy my product !? !? !? !? !? !? Buy my product !!!!!!!!!.......!!!!!!!! Buy my product <----------- Some acceptable solution… >>> More
Where to sanitize PHP $_POST[] input ?

as seen on Stack Overflow - Search for 'Stack Overflow'
I am using codeigniter framework. where should i sanitize PHP input - controller or model ? >>> More