# How to sanitize \_before\_ going into the database?

**URL:** <https://www.ruby-forum.com/t/how-to-sanitize-before-going-into-the-database/127791>\
**Category:** Rails\
**Created:** [February 1, 2008, 11:18am UTC](https://www.ruby-forum.com/t/how-to-sanitize-before-going-into-the-database/127791 "2008-02-01T11:18:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![fjan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/6de8d8/32.png) [@fjan](https://www.ruby-forum.com/u/fjan)\
**Post date:** [February 1, 2008, 11:18am UTC](https://www.ruby-forum.com/t/how-to-sanitize-before-going-into-the-database/127791/1 "2008-02-01T11:18:09Z")

</div>

I use a call to the sanitize method every time I render some user  
input, but it would be much nicer if I could clean it up once before  
putting it into the database and avoid having to call the (relatively  
expensive) sanitize every time I render a page.

My first thought was to just add something like:

def message=(x)  
self[:message]=sanitize(x)  
end

However, the sanitize helper cannot be called from inside a model. So  
what would be an elegant way to do this? Stuffing this inside the  
controller seems awkward (and I would have to put it in several  
places).

Any thoughts?

---

<div class="post-metadata">

**Author:** ![fjan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/6de8d8/32.png) [@fjan](https://www.ruby-forum.com/u/fjan)\
**Post date:** [February 1, 2008, 11:40am UTC](https://www.ruby-forum.com/t/how-to-sanitize-before-going-into-the-database/127791/2 "2008-02-01T11:40:00Z")

</div>

On 01 Feb 2008, at 11:17, Fjan wrote:

> However, the sanitize helper cannot be called from inside a model. So  
> what would be an elegant way to do this? Stuffing this inside the  
> controller seems awkward (and I would have to put it in several  
> places).
> 
> Any thoughts?

Although I’m against destructive actions on user entered data (if you  
sanitize before saving, you can never recover what the user initially  
entered), there’s a plugin that does just that:  
[http://agilewebdevelopment.com/plugins/acts\_as\_sanitized](http://agilewebdevelopment.com/plugins/acts_as_sanitized)

If you want to do it automatically so you don’t have to call h or  
sanitize in your views, you could use xss\_terminate:  
[http://agilewebdevelopment.com/plugins/xss\_terminate](http://agilewebdevelopment.com/plugins/xss_terminate)

You could have easily found this yourself by having a quick search at  
the agilewebdevelopment site:  
[http://agilewebdevelopment.com/plugins/search?search=sanitize](http://agilewebdevelopment.com/plugins/search?search=sanitize)

Best regards

Peter De Berdt

---

<div class="post-metadata">

**Author:** ![fjan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/6de8d8/32.png) [@fjan](https://www.ruby-forum.com/u/fjan)\
**Post date:** [February 1, 2008, 12:46pm UTC](https://www.ruby-forum.com/t/how-to-sanitize-before-going-into-the-database/127791/3 "2008-02-01T12:46:15Z")

</div>

Thank you, I actually did stumble onto the two you mentioned after  
writing my original post. But it seems acts\_as\_sanitized is no longer  
maintained and xss\_terminate is too destructive for my purpose as it  
includes itself in base and strips out everything everywhere unless  
you tell it not to. I have a lot of models I would need to go over and  
I agree I’m also against destructive actions on user entered data  
except for the few cases where it would be a real performance boost.

Instead of installing all kinds of plugins, would there be any problem  
in simply doing this inside a model:

include ActionView::Helpers::SanitizeHelper  
def message=(x)  
self[:message]=sanitize(x)  
end

---

<div class="post-metadata">

**Author:** ![fjan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/6de8d8/32.png) [@fjan](https://www.ruby-forum.com/u/fjan)\
**Post date:** [February 1, 2008, 10:27pm UTC](https://www.ruby-forum.com/t/how-to-sanitize-before-going-into-the-database/127791/4 "2008-02-01T22:27:13Z")

</div>

If you’re willing to add fields to your model, you can get around the  
destructive action issue simply by storing the original input along  
with the sanitized version. Use the unsanitized field in “edit” forms  
and display the sanitized field in “show” views. Use a before\_save  
callback to do the sanitizing during any edit.

So for instance, to clean up user input for a Comment model, have both  
comment\_text and comment\_html fields, then run comment\_text through  
RedCloth (if you’re using textile), white\_list (to clip out nasty  
tags), and hpricot (to close open tags) and stuff into comment\_html  
(via a before\_save method). Display comment\_html but let the user re-  
edit comment\_text – which gets cleaned back up and saved in  
comment\_html.

---

<div class="post-metadata">

**Author:** ![fjan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/6de8d8/32.png) [@fjan](https://www.ruby-forum.com/u/fjan)\
**Post date:** [February 1, 2008, 10:36pm UTC](https://www.ruby-forum.com/t/how-to-sanitize-before-going-into-the-database/127791/5 "2008-02-01T22:36:03Z")

</div>

I released another (Cross Site Sniper) earlier this week…

[http://xss.rubyforge.org/](http://xss.rubyforge.org/)

Peter De Berdt wrote:

> > def message=(x)
> 
> the agilewebdevelopment site:

–  
[http://www.5valleys.com/](http://www.5valleys.com/)  
[http://www.workingwithrails.com/person/8078](http://www.workingwithrails.com/person/8078)