# Preventing XSS attacks in rails

**URL:** <https://www.ruby-forum.com/t/preventing-xss-attacks-in-rails/105656>\
**Category:** Rails\
**Created:** [June 1, 2007, 2:45am UTC](https://www.ruby-forum.com/t/preventing-xss-attacks-in-rails/105656 "2007-06-01T02:45:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hyped](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/7feea3/32.png) [@hyped](https://www.ruby-forum.com/u/hyped)\
**Post date:** [June 1, 2007, 2:45am UTC](https://www.ruby-forum.com/t/preventing-xss-attacks-in-rails/105656/1 "2007-06-01T02:45:37Z")

</div>

I have a script that uses the NET::HTTP class to scrape information off  
of a website. I take that html and insert it into a database. How do I  
escape all tags before inserting into database? Anything similar to  
PHP’s mysql\_escape\_string? Or do I just invoke the h() or sanitize()  
functions in the view before displaying the data?

---

<div class="post-metadata">

**Author:** ![hyped](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/7feea3/32.png) [@hyped](https://www.ruby-forum.com/u/hyped)\
**Post date:** [June 1, 2007, 3:07am UTC](https://www.ruby-forum.com/t/preventing-xss-attacks-in-rails/105656/2 "2007-06-01T03:07:34Z")

</div>

On 5/31/07, hyped [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I have a script that uses the NET::HTTP class to scrape information off  
> of a website. I take that html and insert it into a database. How do I  
> escape all tags before inserting into database? Anything similar to  
> PHP’s mysql\_escape\_string? Or do I just invoke the h() or sanitize()  
> functions in the view before displaying the data?

I have a white\_list helper for this:  
[http://svn.techno-weenie.net/projects/plugins/white\_list/](http://svn.techno-weenie.net/projects/plugins/white_list/)

h() will escape _everything_ and sanitize() misses a lot of edge cases.

–  
Rick O.  
[http://lighthouseapp.com](http://lighthouseapp.com)  
[http://weblog.techno-weenie.net](http://weblog.techno-weenie.net)  
[http://mephistoblog.com](http://mephistoblog.com)

---

<div class="post-metadata">

**Author:** ![hyped](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/7feea3/32.png) [@hyped](https://www.ruby-forum.com/u/hyped)\
**Post date:** [June 1, 2007, 10:42am UTC](https://www.ruby-forum.com/t/preventing-xss-attacks-in-rails/105656/3 "2007-06-01T10:42:25Z")

</div>

Hi Rick,

I recently came across a little bug in your plugin. I was eventually  
going to file a bug report, but since it was mentioned on the list, I  
thought I’d report it here…

The following test fails on the latest svn rev…

def test\_closing\_tag\_regex\_should\_be\_less\_greedy  
assert\_white\_listed %(BEFORE  
AFTER **BOLD!** ),  
%(BEFORE AFTER **BOLD!** )  
end

-christos