What's the "h" mean in "<%=h"?

Question

When I generate a default scaffold, the display tags on show.html.erb have

<%=h @broker.name %>

I know the difference between <% and <%=. What's the "h" do?

Answer 1

html escape. It's a method that converts things like < and > into numerical character references so that rendering won't break your html.

Answer 2

<%=h is actually 2 things happening. You're opening an erb tag (<%=) and calling the Rails method 'h' to escape all symbols.

These two calls are equivalent:

<%=h person.first_name %> <%= h(person.first_name) %>

The "h" method is commonly used to escape HTML and Javascript from user-input forms.

Answer 3

It's worth noting that h is a method alias for html_escape from the ERB::Util class and you can find ERB API docs here:

http://www.ruby-doc.org/core/classes/ERB/Util.html

Answer 4

There is also a method in Rack to escape HTML Rack::Utils.escape_html in case you are in Metal and want to escape some HTML.