# Escaping characters in controller

**URL:** <https://www.ruby-forum.com/t/escaping-characters-in-controller/76921>\
**Category:** Rails\
**Created:** [November 22, 2006, 2:18pm UTC](https://www.ruby-forum.com/t/escaping-characters-in-controller/76921 "2006-11-22T14:18:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Domas\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/9fc348/32.png) [@Domas\_S](https://www.ruby-forum.com/u/Domas_S)\
**Post date:** [November 22, 2006, 2:18pm UTC](https://www.ruby-forum.com/t/escaping-characters-in-controller/76921/1 "2006-11-22T14:18:34Z")

</div>

How can I escape characters in controller?  
I mean replacing ‘"’ to ‘&quot’, ‘&’ to ‘&’ and so on?

---

<div class="post-metadata">

**Author:** ![Domas\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/9fc348/32.png) [@Domas\_S](https://www.ruby-forum.com/u/Domas_S)\
**Post date:** [November 22, 2006, 4:18pm UTC](https://www.ruby-forum.com/t/escaping-characters-in-controller/76921/2 "2006-11-22T16:18:50Z")

</div>

On 11/22/06, Domas S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> How can I escape characters in controller?  
> I mean replacing ‘"’ to ‘&quot’, ‘&’ to ‘&’ and so on?

The way I used to do it was include the helper module that defined  
‘html\_escape’, or the alias method ‘h’, then they became available.

What’s strange here is html\_escape is nowhere to be found on  
[http://api.rubyonrails.com/](http://api.rubyonrails.com/)

Am I missing something, or is it too early, or both?!

–

Chris M.  
Web D.  
Open Source & Web Standards Advocate

> **[Chriscodes.com is for sale | HugeDomains](https://www.hugedomains.com/domain_profile.cfm?d=chriscodes.com)**
>
> Painless, quick delivery of your domain name. Fast and professional service.

---

<div class="post-metadata">

**Author:** ![Domas\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/9fc348/32.png) [@Domas\_S](https://www.ruby-forum.com/u/Domas_S)\
**Post date:** [November 22, 2006, 4:32pm UTC](https://www.ruby-forum.com/t/escaping-characters-in-controller/76921/3 "2006-11-22T16:32:52Z")

</div>

On Nov 22, 2006, at 2:15 PM, Domas S. wrote:

> How can I escape characters in controller?  
> I mean replacing ‘"’ to ‘&quot’, ‘&’ to ‘&’ and so on?

Just in case, it is a bit suspicious to escape data in the  
controller, normally is the view who knows whether it needs to apply  
anything to the raw data to have it displayed correctly. If the view  
is rhtml that is a call to h().

Why do you need that?

– fxn

---

<div class="post-metadata">

**Author:** ![Domas\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/9fc348/32.png) [@Domas\_S](https://www.ruby-forum.com/u/Domas_S)\
**Post date:** [November 22, 2006, 5:13pm UTC](https://www.ruby-forum.com/t/escaping-characters-in-controller/76921/4 "2006-11-22T17:13:03Z")

</div>

I have a class that generates flash object html declaration. The class  
instance is created in controller and passed to view where it ouputs  
html code using to\_html method. So I though about initializing my  
class using already escaped data. Of course I could do escaping in the  
class itself, but I wanted to know if there’s a standard way to do it.

To Chris:  
html\_escape is in file erb.rb, thanks for hint.

---

<div class="post-metadata">

**Author:** ![Domas\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/9fc348/32.png) [@Domas\_S](https://www.ruby-forum.com/u/Domas_S)\
**Post date:** [November 22, 2006, 5:33pm UTC](https://www.ruby-forum.com/t/escaping-characters-in-controller/76921/5 "2006-11-22T17:33:05Z")

</div>

On 11/22/06, Domas S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> To Chris:  
> html\_escape is in file erb.rb, thanks for hint.

Nice.  
I still could’ve sworn that these methods used to be listed in the  
method list in the docs.

Can anyone shed some light on why they’re not anymore?  
Or tell me I’m crazy, and they were never there in the first place.

–

Chris M.  
Web D.  
Open Source & Web Standards Advocate

> **[Chriscodes.com is for sale | HugeDomains](https://www.hugedomains.com/domain_profile.cfm?d=chriscodes.com)**
>
> Painless, quick delivery of your domain name. Fast and professional service.

---

<div class="post-metadata">

**Author:** ![Domas\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/9fc348/32.png) [@Domas\_S](https://www.ruby-forum.com/u/Domas_S)\
**Post date:** [November 22, 2006, 5:45pm UTC](https://www.ruby-forum.com/t/escaping-characters-in-controller/76921/6 "2006-11-22T17:45:06Z")

</div>

On Nov 22, 2006, at 5:11 PM, Domas S. wrote:

> I have a class that generates flash object html declaration. The class  
> instance is created in controller and passed to view where it ouputs  
> html code using to\_html method. So I though about initializing my  
> class using already escaped data. Of course I could do escaping in the  
> class itself, but I wanted to know if there’s a standard way to do it.

You can have them available anywhere mixin the module from Action  
View where the helper you need is defined.

Having said that, with the given information I’d say that generator  
would receive normal strings, and encode them as needed for #to\_html.  
To do that the class would mixin ERB::Util, which is the module that  
provides html\_escape in RHTML templates.

– fxn