# Can I use ERB templates securely

**URL:** <https://www.ruby-forum.com/t/can-i-use-erb-templates-securely/138798>\
**Category:** Rails\
**Created:** [May 27, 2008, 9:31pm UTC](https://www.ruby-forum.com/t/can-i-use-erb-templates-securely/138798 "2008-05-27T21:31:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nateleavitt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/3bc359/32.png) [@nateleavitt](https://www.ruby-forum.com/u/nateleavitt)\
**Post date:** [May 27, 2008, 9:31pm UTC](https://www.ruby-forum.com/t/can-i-use-erb-templates-securely/138798/1 "2008-05-27T21:31:29Z")

</div>

Hello,

I’m building a system that will allow users to modify layouts. Is there  
a way to securely use ERB, or will I need to use a different template  
engine such as Liquid?

I would prefer to use ERB, but haven’t found a way to allow people to  
modify the templates without having access to running malicious code.

Any input would be helpful.

Thanks!

---

<div class="post-metadata">

**Author:** ![nateleavitt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/3bc359/32.png) [@nateleavitt](https://www.ruby-forum.com/u/nateleavitt)\
**Post date:** [May 28, 2008, 1:00am UTC](https://www.ruby-forum.com/t/can-i-use-erb-templates-securely/138798/2 "2008-05-28T01:00:01Z")

</div>

Since ERB allows you to call any ruby code, including calls to the  
database,  
or even system calls, I think that wouldn’t be a great idea for user  
templates.

On May 27, 2:31 pm, Nate L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![nateleavitt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/3bc359/32.png) [@nateleavitt](https://www.ruby-forum.com/u/nateleavitt)\
**Post date:** [May 28, 2008, 1:34am UTC](https://www.ruby-forum.com/t/can-i-use-erb-templates-securely/138798/3 "2008-05-28T01:34:33Z")

</div>

You will need to use a different templating language such as Liquid.

–  
Appreciated my help?  
Recommend me on Working With Rails  
[http://workingwithrails.com/person/11030-ryan-bigg](http://workingwithrails.com/person/11030-ryan-bigg)

---

<div class="post-metadata">

**Author:** ![nateleavitt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/3bc359/32.png) [@nateleavitt](https://www.ruby-forum.com/u/nateleavitt)\
**Post date:** [May 28, 2008, 4:55am UTC](https://www.ruby-forum.com/t/can-i-use-erb-templates-securely/138798/4 "2008-05-28T04:55:00Z")

</div>

Ryan B. wrote:

> You will need to use a different templating language such as Liquid.
> 
> –  
> Appreciated my help?  
> Recommend me on Working With Rails  
> [http://workingwithrails.com/person/11030-ryan-bigg](http://workingwithrails.com/person/11030-ryan-bigg)

Yep. This was the need liquid was made for. Every shopify store uses  
liquid, and most of them look fantastic.