\
**Category:** Rails\
**Created:** [April 24, 2009, 4:05pm UTC](https://www.ruby-forum.com/t/html-safe-and-h/166381 "2009-04-24T16:05:52Z")\
**Posts on this page:** 3\
**Page:** 1
**Author:**  [@Suman\_G](https://www.ruby-forum.com/u/Suman_G)\
**Post date:** [April 24, 2009, 4:05pm UTC](https://www.ruby-forum.com/t/html-safe-and-h/166381/1 "2009-04-24T16:05:52Z")
Hi all,
This is kinda a noob question. Can someone please explain what html
safe mean, and what the function h in rails do and what are the best
times to use it. Even links will be helpful but i am doubtful if any
good explanations exists because i did a little search on couldn’t get
more info.
I know that \<%=h tries to make the whatever we are writing to the web
page as html safe by stripping out all the html tags. Does this
include all the tags also??
thanks in advance.
suman
---
**Author:**  [@Suman\_G](https://www.ruby-forum.com/u/Suman_G)\
**Post date:** [April 24, 2009, 7:01pm UTC](https://www.ruby-forum.com/t/html-safe-and-h/166381/2 "2009-04-24T19:01:18Z")
On Apr 24, 10:05 am, Suman G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
[…]
> I know that \<%=h tries to make the whatever we are writing to the web
> page as html safe by stripping out all the html tags. Does this
> include all the tags also??
Well, is an HTML tag, isn’t it?
Anyway, it’s not quite true that h removes HTML tags. Rather, what it
does is escape characters that have a special meaning in HTML, so that
“” will become “\”.
> thanks in advance.
>
> suman
## Best,
Marnen Laibow-Koser
[http://www.marnen.org](http://www.marnen.org)
removed\_email\_address@domain.invalid
---
**Author:**  [@Suman\_G](https://www.ruby-forum.com/u/Suman_G)\
**Post date:** [April 24, 2009, 8:18pm UTC](https://www.ruby-forum.com/t/html-safe-and-h/166381/3 "2009-04-24T20:18:41Z")
Alright. And that is how the XSS attack is prevented.
Suman