CODEWITHSUNDEEP
ruby-on-rails
Tolga
Tolga

Reputation: 1357

Rails - View Template - Insert <BR> within ERB Tag

I would like to insert HTML <BR> tag within the link_to ERB tag as show below:

<%= link_to((@Name + "<BR>" + @Surname), my_action_path %>

What would be the correct way of doing this?

Upvotes: 0

Views: 605

Answers (3)

Simple Lime
Simple Lime

Reputation: 11035

Since @Name and @Surname seem like they could be user-entered, you'll want to be careful here...

<% @name = "<script>alert('bad');</script>First Name"
   @surname = "<script>alert('another bad');</script>Last Name" %>

<%= link_to(("".html_safe + @name + "<br />".html_safe + @surname), '#') %>

Trying with either of the other answers leaves you with 2 alert boxes (meaning you now have a XSS vulnerability)...this way outputs the script tags as text

Upvotes: 0

Sachin R
Sachin R

Reputation: 11876

(@Name + "<BR>" + @Surname).html_safe

Upvotes: 2

Nazeef Ahmad Meer
Nazeef Ahmad Meer

Reputation: 113

<%= link_to( raw(@Name+"<br>"+@Surname) , my_action_path ) %>

You can achieve this using 'raw' function provided by rails.

Upvotes: 2

Related Questions