# Escaping Data to Prevent XSS When It Gets Stored

**URL:** <https://www.ruby-forum.com/t/escaping-data-to-prevent-xss-when-it-gets-stored/110162>\
**Category:** Rails\
**Created:** [July 23, 2007, 9:37pm UTC](https://www.ruby-forum.com/t/escaping-data-to-prevent-xss-when-it-gets-stored/110162 "2007-07-23T21:37:57Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [July 23, 2007, 9:37pm UTC](https://www.ruby-forum.com/t/escaping-data-to-prevent-xss-when-it-gets-stored/110162/1 "2007-07-23T21:37:57Z")

</div>

It seems to me that escaping data about to appear in a view in an  
rhtml template using h / html\_escape is further downstream than you  
really want to be escaping certain data. Wouldn’t it make more sense  
to escape data _before_ you store it in the database? This way any  
code that subsequently picks up the data doesn’t have to worry,  
correct? Has anyone done this? Is there a reason you _wouldn’t_ want  
to escape the data prior storage?