\
**Category:** Ruby\
**Created:** [June 28, 2007, 8:27pm UTC](https://www.ruby-forum.com/t/escaping-stripping-all-user-html-input/108061 "2007-06-28T20:27:18Z")\
**Posts on this page:** 2\
**Page:** 1
**Author:**  [@luis](https://www.ruby-forum.com/u/luis)\
**Post date:** [June 28, 2007, 8:27pm UTC](https://www.ruby-forum.com/t/escaping-stripping-all-user-html-input/108061/1 "2007-06-28T20:27:18Z")
I am writing an application where I know that I do not need to allow
any HTML input from a user.
I am considering using before\_filter at the controller level to call a
method that essentially performs the following on the appropriate
members of the params hash:
- call strip\_tags()
- escape any remaining characters with h()
The reason why I am doing this is it seems repetitive and error prone
to have to call the above method every time in a view where user input
is being displayed. Ultimately, I would prefer to store the data in as
“non-malicious” format as possible and not have to worry at the
presentation level of escaping that data at a later time.
Is there a better way to do this? Is there existing code that does
this already? Some googling yielded nothing specific other than
postings to the effect of “in your view, make sure to use h()”.
---
**Author:**  [@luis](https://www.ruby-forum.com/u/luis)\
**Post date:** [June 28, 2007, 9:13pm UTC](https://www.ruby-forum.com/t/escaping-stripping-all-user-html-input/108061/2 "2007-06-28T21:13:30Z")
Oh woops, my mistake! Meant to send this to the Rails list.