Sanitizing input for display in view when using simple_format

Question

Hi,

I'm trying to figure out the right way to display comments such that newlines and links are displayed. I know that usually, you should display user-inputs only when escaping html with h(). That of course won't display newlines or links, so I found the simple_format and auto_link methods.

What I am now doing is: simple_format(santize(auto_link(comment.text)))

Is this the right way to do this, and is it still safe from XSS attacks?

Thanks! Eric

Answer 1

Hi,

Have a look to the last ryanb screencast XSS Protection in Rails 3

Cheers