Sanitizing input for display in view when using simple_format
- by Eric
Hi,
I'm trying to figure out the right way to display comments such that newlines and links are displayed. I know that usually, you should display user-inputs only when escaping html with h(). That of course won't display newlines or links, so I found the simple_format and auto_link methods.
What I am now doing is: simple_format(santize(auto_link(comment.text)))
Is this the right way to do this, and is it still safe from XSS attacks?
Thanks!
Eric