# Help with sanitize and escaping **URL:** \ **Category:** Rails\ **Created:** [January 19, 2007, 2:41pm UTC](https://www.ruby-forum.com/t/help-with-sanitize-and-escaping/82318 "2007-01-19T14:41:18Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![nick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/f9ae1b/32.png) [@nick](https://www.ruby-forum.com/u/nick)\ **Post date:** [January 19, 2007, 2:41pm UTC](https://www.ruby-forum.com/t/help-with-sanitize-and-escaping/82318/1 "2007-01-19T14:41:18Z")
Hi, i don’t know when to sanitize, i’ve some user’s input and i think it’s a good idea to sanitize it, but i don’t know if do it when i save the data in the database or every time i show it in the view maybe it’s better for the performance do it before instead of every time, what do you think? are there cons to sanitize data before save it? ---
**Author:** ![nick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/f9ae1b/32.png) [@nick](https://www.ruby-forum.com/u/nick)\ **Post date:** [January 19, 2007, 8:03pm UTC](https://www.ruby-forum.com/t/help-with-sanitize-and-escaping/82318/2 "2007-01-19T20:03:03Z")
nick wrote: > Hi, i don’t know when to sanitize, i’ve some user’s input and i think > it’s a good idea to sanitize it, but i don’t know if do it when i save > the data in the database or every time i show it in the view > maybe it’s better for the performance do it before instead of every > time, what do you think? > are there cons to sanitize data before save it? help ☹ ---
**Author:** ![nick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/f9ae1b/32.png) [@nick](https://www.ruby-forum.com/u/nick)\ **Post date:** [January 19, 2007, 10:33pm UTC](https://www.ruby-forum.com/t/help-with-sanitize-and-escaping/82318/3 "2007-01-19T22:33:32Z")
I do my sanitizing before I put the data in the table. I have the following function in application.rb: include ActionView::Helpers::TextHelper def clean\_up(input) sanitize(strip\_tags(input.strip)) unless input==nil end If you want to strip out HTML even better, take a look at the WhiteListHelper plugin: [http://www.agilewebdevelopment.com/plugins/whitelist](http://www.agilewebdevelopment.com/plugins/whitelist) Kind regards, ## Nick S. > **[Ruby on Rails hosting companies - Compare, review and find your next ROR host](https://railshostinginfo.com)** > > Are you looking for a good and reliable Ruby on Rails hosting company? We have lined them up so you can easily compare and review them. Compare and review Rails hosting ---
**Author:** ![nick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/f9ae1b/32.png) [@nick](https://www.ruby-forum.com/u/nick)\ **Post date:** [January 20, 2007, 12:51pm UTC](https://www.ruby-forum.com/t/help-with-sanitize-and-escaping/82318/4 "2007-01-20T12:51:55Z")
Mark Reginald J. wrote: > The one advantage of not storing sanitized and escaped versions > is that if the user enters something like > > **Abcde** > > in a text field, they will see exactly what they entered in both > h-escaped > text, and in re-filled forms, while if an escaped version has been > stored > they will see > > \Abcde\ > > in the text box. > > – > We develop, watch us RoR, in numbers too big to ignore. so it’s better to escape the html win output and not in input? but so there’re are dry and performance problems ---
**Author:** ![nick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/f9ae1b/32.png) [@nick](https://www.ruby-forum.com/u/nick)\ **Post date:** [January 19, 2007, 10:58pm UTC](https://www.ruby-forum.com/t/help-with-sanitize-and-escaping/82318/5 "2007-01-19T22:58:10Z")
Nick S. wrote: > I do my sanitizing before I put the data in the table. Yeah this is the right way to do it (sanitize on input). I don’t know why the “standard” why (as promoted in Agile book I believe) only stresses escaping output. The advantages of doing it at input: -Only have to do it once versus having to use functions like h() many times for the same data (what about DRY?). -If other apps use your data you do not have to rely on them doing the right thing. Really I think a lot of XSS issues could be avoided if frameworks like this would _sanitize by default_ and require sanitization to be specifically turned off. I suppose it should be pretty straightforward to put a :before\_filter in application.rb that cleans up params? Carl ---
**Author:** ![nick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/f9ae1b/32.png) [@nick](https://www.ruby-forum.com/u/nick)\ **Post date:** [January 20, 2007, 11:33am UTC](https://www.ruby-forum.com/t/help-with-sanitize-and-escaping/82318/6 "2007-01-20T11:33:14Z")
Carl J. wrote: > -Only have to do it once versus having to use functions like h() many > times for the same data (what about DRY?). > -If other apps use your data you do not have to rely on them doing the > right thing. The one advantage of not storing sanitized and escaped versions is that if the user enters something like **Abcde** in a text field, they will see exactly what they entered in both h-escaped text, and in re-filled forms, while if an escaped version has been stored they will see \Abcde\ in the text box. – We develop, watch us RoR, in numbers too big to ignore. ---
**Author:** ![nick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/f9ae1b/32.png) [@nick](https://www.ruby-forum.com/u/nick)\ **Post date:** [January 20, 2007, 11:09pm UTC](https://www.ruby-forum.com/t/help-with-sanitize-and-escaping/82318/7 "2007-01-20T23:09:33Z")
and what do you think about a validates\_format\_of which check that there isn’t any \< and \> ? obviously only in fields like name, surname, street, etc…for other maybe it’s better sanitize and if i do this expression do you think I’ll need also to do an html escape? (just to be sure, the expression is like: /^[\<\>]$/ ?) thanks :o)