CODEWITHSUNDEEP
ruby-on-railsruby-on-rails-3xss
Josh Rickard
Josh Rickard

Reputation: 1603

Safely display html encoded values in Rails

Assuming I have the following string:

Frozen Synapse – A Business Mini-Postmortem!

Is there a way to white list specific html encoded values or should I just perform:

string.gsub('–', '-')

to produce the desired output in an HTML view:

Frozen Synapse – A Business Mini-Postmortem!

Edit: there may be other html in the string that I don't want to allow. I want to white list certain html encoded characters (like a dash).

Upvotes: 0

Views: 191

Answers (1)

matkins
matkins

Reputation: 1991

You can use the html_safe method in your view. E.g.

<%="Frozen Synapse &#8211; A Business Mini-Postmortem!".html_safe%>

Upvotes: 1

Related Questions