# Escaping user data in\_place\_editor

**URL:** <https://www.ruby-forum.com/t/escaping-user-data-in-place-editor/123605>\
**Category:** Rails\
**Created:** [December 19, 2007, 2:36am UTC](https://www.ruby-forum.com/t/escaping-user-data-in-place-editor/123605 "2007-12-19T02:36:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c89c15/32.png) [@tomn](https://www.ruby-forum.com/u/tomn)\
**Post date:** [December 19, 2007, 2:36am UTC](https://www.ruby-forum.com/t/escaping-user-data-in-place-editor/123605/1 "2007-12-19T02:36:39Z")

</div>

Uh oh,

I just got the in\_place\_editor\_field almost working and I realized that  
I was no longer escaping all user inputted text. I’ve caught the  
general drift that evil people will eat my database alive if I display  
nefarious input they could put in?

Is that a good reason not to use that feature?

I’m going to need to find some good bullet proof filters to put user  
inputted data through regardless I suppose?

---

<div class="post-metadata">

**Author:** ![tomn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c89c15/32.png) [@tomn](https://www.ruby-forum.com/u/tomn)\
**Post date:** [December 19, 2007, 2:47am UTC](https://www.ruby-forum.com/t/escaping-user-data-in-place-editor/123605/2 "2007-12-19T02:47:00Z")

</div>

Also, what about text that appears in text field boxes when the  
application pulls up user information to edit?

I guess that must be somehow escaped so maybe that same means might be  
worked into the in\_place\_editor?