# Erb question

**URL:** <https://www.ruby-forum.com/t/erb-question/176546>\
**Category:** Rails\
**Created:** [October 1, 2009, 10:15pm UTC](https://www.ruby-forum.com/t/erb-question/176546 "2009-10-01T22:15:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![spokra](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ba8739/32.png) [@spokra](https://www.ruby-forum.com/u/spokra)\
**Post date:** [October 1, 2009, 10:15pm UTC](https://www.ruby-forum.com/t/erb-question/176546/1 "2009-10-01T22:15:25Z")

</div>

I currently have a page controller that gets html content from the DB  
and then renders it. is there a way to use ERB to pre process the  
html and make it rhtml? allowing me to post more dynamic content…

---

<div class="post-metadata">

**Author:** ![spokra](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ba8739/32.png) [@spokra](https://www.ruby-forum.com/u/spokra)\
**Post date:** [October 1, 2009, 10:45pm UTC](https://www.ruby-forum.com/t/erb-question/176546/2 "2009-10-01T22:45:01Z")

</div>

spokra wrote:

> I currently have a page controller that gets html content from the DB  
> and then renders it. is there a way to use ERB to pre process the  
> html and make it rhtml?

I suppose so, but this is a bad idea from a security point of view.  
It’s too easy for someone to put into the DB a malicious piece of ERb  
code, say, something like

# This is a malicious page!
\<% User.delete\_all %\>

> allowing me to post more dynamic content…

There are better ways to do this. Can you explain more about your  
application?

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![spokra](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ba8739/32.png) [@spokra](https://www.ruby-forum.com/u/spokra)\
**Post date:** [October 1, 2009, 11:02pm UTC](https://www.ruby-forum.com/t/erb-question/176546/3 "2009-10-01T23:02:15Z")

</div>

the page controller is only accessible to admins for one…

I’d like to be able to create pages on the fly that include blog  
posting, news events top stories. and I don;t want to be changing the  
view files all the time. I guess I could make one page for each page  
type like the home page that include what i want…

I guess the quick way to explain what i’m trying to do is make a cms  
that is erb aware

On Oct 1, 1:45 pm, Marnen Laibow-Koser \<rails-mailing-l…@andreas-

---

<div class="post-metadata">

**Author:** ![spokra](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ba8739/32.png) [@spokra](https://www.ruby-forum.com/u/spokra)\
**Post date:** [October 2, 2009, 3:51am UTC](https://www.ruby-forum.com/t/erb-question/176546/4 "2009-10-02T03:51:25Z")

</div>

spokra wrote:

> the page controller is only accessible to admins for one.

That’s kind of weak security when coupled with such a dangerous idea.

> I’d like to be able to create pages on the fly that include blog  
> posting, news events top stories. and I don;t want to be changing the  
> view files all the time. I guess I could make one page for each page  
> type like the home page that include what i want…
> 
> I guess the quick way to explain what i’m trying to do is make a cms  
> that is erb aware

Again, bad idea. Most CMSs include some for of template language that  
will do what you want (for example, Radius within the Radiant CMS), but  
by design, these languages never have all the features of ERb –  
specifically, they can’t execute arbitrary Ruby code. And that’s the  
way it should be.

With that in mind, then, why not give a CMS like Radiant a try?

> On Oct 1, 1:45�pm, Marnen Laibow-Koser \<rails-mailing-l…@andreas-

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid