rails: how to html encode/escape a string? is there a built-in?

Question

Yay, silly question time.

So I have an untrusted string that I simply want to show as text in an html page. All I need to do is escape the chars '<' and '&' as html entities.

The less fuss the better. I'm using utf8 and don't need no other stinking entities for accented letters and so on.

Is there anything built-in in ruby or rails, or should I roll my own?

Answer 1

The h helper method!

<%=h "<p> will be preserved" %>

Answer 2

You can use either h() or html_escape(), but most people use h() by convention. h() is short for html_escape() in rails.

In your controller:

@stuff = "<b>Hello World!</b>"

In your view:

<%=h @stuff %>

If you view the HTML source: you will see the output without actually bolding the data. I.e. it is encoded as <b>Hello World!</b>.

It will appear an be displayed as <b>Hello World!</b>

Answer 3

doesn't appear to encode double-quotes.

Answer 4

Checkout the Ruby CGI class. There are methods to encode and decode HTML as well as URLs.

CGI::escapeHTML('Usage: foo "bar" <baz>')
# => "Usage: foo &quot;bar&quot; &lt;baz&gt;"