RHTML displaying HTML tags on output

Question

I have an RHTML view in Rails, where the output is coming from my MongoDB collection. The data is outputted correctly using an iteration block, but whenever I try and have HTML tags in my database, they are not rendered in the HTML output, instead they are just displayed.

<%
 @posts.find().each do |post|
%>
 <h1><%=post["name"]%></h1>
 <p><%=post["body"] %></p>
 <p><%=post["timestamp"]%></p>
<%
 end
%>

But, for instance, if I had

<p>Test</p>

In my database, the tags would be rendered, instead of being printed.

You shouldn't need the find() after @posts

Mark Thomas
– Mark Thomas

2010-12-15 13:27:06 +00:00
Commented Dec 15, 2010 at 13:27 — Mark Thomas
– Mark Thomas, Commented Dec 15, 2010 at 13:27
if @posts is a collection object he does

Matt Briggs
– Matt Briggs

2010-12-15 13:30:05 +00:00
Commented Dec 15, 2010 at 13:30 — Matt Briggs
– Matt Briggs, Commented Dec 15, 2010 at 13:30

Mark Thomas · Accepted Answer · 2010-12-15 18:49:57Z

6

This is a security precaution that is now built into Rails 3. It prevents XSS (cross-site scripting) issues.

If you add raw you'll get the output you want.

<% @posts.each do |post| %> 
 <h1><%=raw post["name"]%></h1> 
 <p><%=raw post["body"] %></p> 
 <p><%=raw post["timestamp"]%></p> 
<% end %>

However, if you are storing user-created arbitrary HTML, I don't recommend you do this unless you are sanitizing the input prior to storing it in the database.

Edit:

Another option: Using the sanitize helper in place of raw, e.g. <%=sanitize post["name"], :tags => "p" %> to allow <p> tags.

edited Dec 15, 2010 at 18:49

answered Dec 15, 2010 at 13:22

Mark Thomas

37.6k11 gold badges78 silver badges101 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

PeterWong · Accepted Answer · 2010-12-15 13:53:53Z

2

Apart from raw and .html_safe, which give 100% trust to the user's input, you could also use sanitize to restrict only a number of tags that allowed.

<%= sanitize post["name"] $>

For the details, see: http://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html

answered Dec 15, 2010 at 13:53

PeterWong

16k9 gold badges62 silver badges69 bronze badges

1 Comment

Mark Thomas Over a year ago

Good point about sanitize. +1 to you and I've updated my answer.

Collectives™ on Stack Overflow

RHTML displaying HTML tags on output

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related