# \<%=h...%\> **URL:** \ **Category:** Rails\ **Created:** [July 21, 2010, 2:56am UTC](https://www.ruby-forum.com/t/h/191943 "2010-07-21T02:56:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![swengineer](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/97f17d/32.png) [@swengineer](https://www.ruby-forum.com/u/swengineer)\ **Post date:** [July 21, 2010, 2:56am UTC](https://www.ruby-forum.com/t/h/191943/1 "2010-07-21T02:56:10Z")
In the “Head First Rails” book, it mentions that “h” in \<%=h…%\> is a helper method. Can someone describe what that means? And, when should I use \<%=h…%\>? Is it when I want the result to be displayed on my view for example? Thanks. ---
**Author:** ![swengineer](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/97f17d/32.png) [@swengineer](https://www.ruby-forum.com/u/swengineer)\ **Post date:** [July 21, 2010, 6:55am UTC](https://www.ruby-forum.com/t/h/191943/2 "2010-07-21T06:55:31Z")
Abder-Rahman A. wrote: > In the “Head First Rails” book, it mentions that “h” in \<%=h…%\> is a > helper method. > > Can someone describe what that means? And, when should I use \<%=h…%\>? > Is it when I want the result to be displayed on my view for example? > > Thanks. Hi, I know the use of \<%=h…%\> is to show the html tags: Consider the following example: @a= “hi how are you.” \<%= @a %\> #=\> hi how are you. \<%=h @a %\> #=\> hi how are you. Regards, Saurabh ---
**Author:** ![swengineer](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/97f17d/32.png) [@swengineer](https://www.ruby-forum.com/u/swengineer)\ **Post date:** [July 21, 2010, 9:12am UTC](https://www.ruby-forum.com/t/h/191943/3 "2010-07-21T09:12:23Z")
On 21 Jul 2010, at 01:56, Abder-Rahman A. wrote: > In the “Head First Rails” book, it mentions that “h” in \<%=h…%\> is a > helper method. > > Can someone describe what that means? And, when should I use \<%=h…%\>? > Is it when I want the result to be displayed on my view for example? h is short for html\_escape. You’re probably end up using it nearly every time you display user entered data (or you may be at the risk of xss attacks). From rails 2.3.8 there’s a different way of handling this - strings have a notion of whether they are safe or not Fred ---
**Author:** ![swengineer](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/97f17d/32.png) [@swengineer](https://www.ruby-forum.com/u/swengineer)\ **Post date:** [July 21, 2010, 10:37am UTC](https://www.ruby-forum.com/t/h/191943/4 "2010-07-21T10:37:58Z")
Frederick C. wrote: > On 21 Jul 2010, at 01:56, Abder-Rahman A. wrote: > > > In the “Head First Rails” book, it mentions that “h” in \<%=h…%\> is a > > helper method. > > > > Can someone describe what that means? And, when should I use \<%=h…%\>? > > Is it when I want the result to be displayed on my view for example? > > h is short for html\_escape. You’re probably end up using it nearly every > time you display user entered data (or you may be at the risk of xss > attacks). From rails 2.3.8 there’s a different way of handling this - > strings have a notion of whether they are safe or not > > Fred Thanks a lot everyone for your replies. Fred, can you just clarify? - html\_escape - XSS attacks Thanks a lot. ---
**Author:** ![swengineer](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/97f17d/32.png) [@swengineer](https://www.ruby-forum.com/u/swengineer)\ **Post date:** [July 21, 2010, 10:57am UTC](https://www.ruby-forum.com/t/h/191943/5 "2010-07-21T10:57:46Z")
On Jul 21, 9:37 am, Abder-Rahman A. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Fred, can you just clarify? > > - html\_escape > [ERB::Util](http://api.rubyonrails.org/classes/ERB/Util.html#M000138) > - XSS attacks that’s a huge topic - [LMGTFY - Let Me Google That For You](http://lmgtfy.com/?q=XSS+attacks) Fred ---
**Author:** ![swengineer](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/97f17d/32.png) [@swengineer](https://www.ruby-forum.com/u/swengineer)\ **Post date:** [July 21, 2010, 11:02am UTC](https://www.ruby-forum.com/t/h/191943/6 "2010-07-21T11:02:45Z")
Frederick C. wrote: > On Jul 21, 9:37�am, Abder-Rahman A. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > Fred, can you just clarify? > > > > - html\_escape > > [ERB::Util](http://api.rubyonrails.org/classes/ERB/Util.html#M000138) > > > - XSS attacks > > that’s a huge topic - [LMGTFY - Let Me Google That For You](http://lmgtfy.com/?q=XSS+attacks) > > Fred Thanks Fred.