\
**Category:** Rails\
**Created:** [March 22, 2008, 1:05am UTC](https://www.ruby-forum.com/t/preventing-javascript-but-allowing-html/132622 "2008-03-22T01:05:35Z")\
**Posts on this page:** 2\
**Page:** 1
**Author:**  [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 22, 2008, 1:05am UTC](https://www.ruby-forum.com/t/preventing-javascript-but-allowing-html/132622/1 "2008-03-22T01:05:35Z")
Is there a way I can take away Javascript from a user input but let
them use HTML? Or rather, is there a built in function that just takes
away and leaves all the other tags in tact or would I have to
make one myself?
---
**Author:**  [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 22, 2008, 2:22pm UTC](https://www.ruby-forum.com/t/preventing-javascript-but-allowing-html/132622/2 "2008-03-22T14:22:51Z")
Mike C wrote:
> Is there a way I can take away Javascript from a user input but let
> them use HTML? Or rather, is there a built in function that just takes
> away and leaves all the other tags in tact or would I have to
> make one myself?
You probably want sanitize:
[http://api.rubyonrails.com/classes/ActionView/Helpers/SanitizeHelper.html#M000936](http://api.rubyonrails.com/classes/ActionView/Helpers/SanitizeHelper.html#M000936)
It will make JavaScript and forms innocuous leaving everything else
intact. You can easily customize it to suit your requirements.