# How to prevent user content from messing up my markup?

**URL:** <https://www.ruby-forum.com/t/how-to-prevent-user-content-from-messing-up-my-markup/135166>\
**Category:** Rails\
**Created:** [April 18, 2008, 6:24pm UTC](https://www.ruby-forum.com/t/how-to-prevent-user-content-from-messing-up-my-markup/135166 "2008-04-18T18:24:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Myron\_M](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f17d59/32.png) [@Myron\_M](https://www.ruby-forum.com/u/Myron_M)\
**Post date:** [April 18, 2008, 6:24pm UTC](https://www.ruby-forum.com/t/how-to-prevent-user-content-from-messing-up-my-markup/135166/1 "2008-04-18T18:24:55Z")

</div>

On my website, I have a page that allows users to leave comments. I’m  
using Rick O.'s Whitelist plugin ([http://svn.techno-weenie.net/](http://svn.techno-weenie.net/)  
projects/plugins/white\_list/) to only allow a, b and i tags in user  
comments. This works great to escape other HTML tags, but it still  
allows the user to improperly use the allowed tags in a way that  
screws up my markup. For example, someone can use an opening i tag  
and forget to close it. My markup will of course no longer validate.  
I don’t know how the different browsers handle it, but at least on  
firefox, everything after the opening i tag will be italics.

How do I prevent user content that can contain a few whitelisted html  
tags from screwing up my markup?

Thanks!

---

<div class="post-metadata">

**Author:** ![Myron\_M](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f17d59/32.png) [@Myron\_M](https://www.ruby-forum.com/u/Myron_M)\
**Post date:** [April 18, 2008, 6:53pm UTC](https://www.ruby-forum.com/t/how-to-prevent-user-content-from-messing-up-my-markup/135166/2 "2008-04-18T18:53:51Z")

</div>

On 18 Apr 2008, at 03:32, Myron M. wrote:

> How do I prevent user content that can contain a few whitelisted html  
> tags from screwing up my markup?

You could always check if the markup is valid, and if not just escape  
all the html out of it.

Fred

---

<div class="post-metadata">

**Author:** ![Myron\_M](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f17d59/32.png) [@Myron\_M](https://www.ruby-forum.com/u/Myron_M)\
**Post date:** [April 18, 2008, 9:01pm UTC](https://www.ruby-forum.com/t/how-to-prevent-user-content-from-messing-up-my-markup/135166/3 "2008-04-18T21:01:20Z")

</div>

On Apr 18, 2008, at 12:52 PM, Frederick C. wrote:

> > allows the user to improperly use the allowed tags in a way that
> 
> Fred

Use Hpricot?

irb\> require ‘rubygems’; gem ‘hpricot’  
=\> true  
irb\> require ‘hpricot’  
=\> true  
irb\> h = Hpricot(“ **bold_italic, too_** _”)  
=\> #\<Hpricot::Doc {elem **“bold” {elem “italic, too”}** }\>  
irb\> h.to\_html  
=\> “ **bolditalic, too** ”_

 

_Note that the closing_ is added.

-Rob

Rob B. [http://agileconsultingllc.com](http://agileconsultingllc.com)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![Myron\_M](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f17d59/32.png) [@Myron\_M](https://www.ruby-forum.com/u/Myron_M)\
**Post date:** [April 21, 2008, 4:44am UTC](https://www.ruby-forum.com/t/how-to-prevent-user-content-from-messing-up-my-markup/135166/4 "2008-04-21T04:44:06Z")

</div>

Guys, thanks for your help. Hpricot worked like a charm. I had heard  
of hpricot before but had forgotten about it and never tried it.

On Apr 19, 3:00 am, Rob B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)