# How to tackle \<script\> tag?

**URL:** <https://www.ruby-forum.com/t/how-to-tackle-script-tag/126432>\
**Category:** Rails\
**Created:** [January 18, 2008, 6:35am UTC](https://www.ruby-forum.com/t/how-to-tackle-script-tag/126432 "2008-01-18T06:35:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vapor](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/5e9695/32.png) [@vapor](https://www.ruby-forum.com/u/vapor)\
**Post date:** [January 18, 2008, 6:35am UTC](https://www.ruby-forum.com/t/how-to-tackle-script-tag/126432/1 "2008-01-18T06:35:55Z")

</div>

I have a text field that takes Title of the post. But a colleague has  
tried to insert in javascript code with tag. how do I display  
this as-it-is and not let is execute?

Thanks

---

<div class="post-metadata">

**Author:** ![vapor](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/5e9695/32.png) [@vapor](https://www.ruby-forum.com/u/vapor)\
**Post date:** [January 18, 2008, 6:42am UTC](https://www.ruby-forum.com/t/how-to-tackle-script-tag/126432/2 "2008-01-18T06:42:10Z")

</div>

you could escape the content via &lth;

or

you could use the ‘h’ or ‘sanatize’ methods in the template. \<\< should  
be automatic almost all of the time

---

<div class="post-metadata">

**Author:** ![vapor](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/5e9695/32.png) [@vapor](https://www.ruby-forum.com/u/vapor)\
**Post date:** [January 18, 2008, 6:45am UTC](https://www.ruby-forum.com/t/how-to-tackle-script-tag/126432/3 "2008-01-18T06:45:28Z")

</div>

h(str):

escapes all html

sanitize(str):

escapes script tags, form tags and javascript attributes (ie.  
onclick=“alert(‘hi’)”

however as of rails 2.0 (maybe 1.2.4 even) sanitize can take parameters  
to specify unique filter options.

---

<div class="post-metadata">

**Author:** ![vapor](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/5e9695/32.png) [@vapor](https://www.ruby-forum.com/u/vapor)\
**Post date:** [January 18, 2008, 6:45am UTC](https://www.ruby-forum.com/t/how-to-tackle-script-tag/126432/4 "2008-01-18T06:45:31Z")

</div>

Keynan P. wrote:

> you could escape the content via &lth;
> 
> or
> 
> you could use the ‘h’ or ‘sanatize’ methods in the template. \<\< should  
> be automatic almost all of the time

could you please write some syntax?  
thanks