The h
method you're calling here:
<%=h @datapost.body %>
is also known as html_escape
- here's the relevant link on Railsbrain. Remove it and your HTML tags should render appropriately.
You should always display code you get from a user with the h
method to prevent cross-site scripting attacks. But if it's code you scraped from a book (or whatever) it should be fine.
Sarah Mei
2009-04-28 23:18:28