# Escaping html?

**URL:** <https://www.ruby-forum.com/t/escaping-html/64957>\
**Category:** Rails\
**Created:** [August 15, 2006, 2:20pm UTC](https://www.ruby-forum.com/t/escaping-html/64957 "2006-08-15T14:20:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pieter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/82dd89/32.png) [@pieter](https://www.ruby-forum.com/u/pieter)\
**Post date:** [August 15, 2006, 2:20pm UTC](https://www.ruby-forum.com/t/escaping-html/64957/1 "2006-08-15T14:20:55Z")

</div>

Hi

I have a wysiwyg html ditor in my app. How do I escape html written to  
the  
database and encoding when I display the content\>

Ty  
Pieter

---

<div class="post-metadata">

**Author:** ![pieter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/82dd89/32.png) [@pieter](https://www.ruby-forum.com/u/pieter)\
**Post date:** [August 15, 2006, 3:16pm UTC](https://www.ruby-forum.com/t/escaping-html/64957/2 "2006-08-15T15:16:24Z")

</div>

I’m not sure if I understand your question. However if you want to  
display literally (not rendered) the actual html that was stored in  
the database then use the ‘h’ helper method to sanitize/escape it like

This displays it literally without rendering the html (sanitized)  
\<%= h @myhtmlcontent %\>

or this renders the html inline  
\<% @myhtmlcontent %\>

Hope that helps,

Jeff B.

---

<div class="post-metadata">

**Author:** ![pieter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/82dd89/32.png) [@pieter](https://www.ruby-forum.com/u/pieter)\
**Post date:** [August 15, 2006, 8:42pm UTC](https://www.ruby-forum.com/t/escaping-html/64957/3 "2006-08-15T20:42:29Z")

</div>

Tx Jeff

I want to sore the html in the database and diaplay it inline. I am  
using  
the tinyce plugin to do the wysiwyg, store it in the database and then  
displays as **bold text** instead of inline.

maybe I should use the ‘h’ helpet when i store?

Anyway - I will play around a bit.

Tx.

---

<div class="post-metadata">

**Author:** ![pieter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/82dd89/32.png) [@pieter](https://www.ruby-forum.com/u/pieter)\
**Post date:** [August 16, 2006, 2:56pm UTC](https://www.ruby-forum.com/t/escaping-html/64957/4 "2006-08-16T14:56:10Z")

</div>

Tx Jeff

Will give it a bash and post my experience.

Stuck in authentication at the mo!

Cheers.  
Pieter.

---

<div class="post-metadata">

**Author:** ![pieter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/82dd89/32.png) [@pieter](https://www.ruby-forum.com/u/pieter)\
**Post date:** [August 16, 2006, 3:37am UTC](https://www.ruby-forum.com/t/escaping-html/64957/5 "2006-08-16T03:37:14Z")

</div>

Pieter,

OK. So if you want it to render inline you would do something like

\<%= @mycontent %\>

but, maybe the reason it isn’t working for you is because what is  
ending up being saved in the database is already escaped like \< is  
saved as \< \> is \>…

So you may need to unescape the html either before you save it or  
before you output it. You can use the CGI class to do this

require ‘cgi’  
unescaped = CGI::unescapeHTML( escapedHtml )

Hope that helps,

Jeff