\
**Category:** Rails\
**Created:** [May 15, 2010, 10:00pm UTC](https://www.ruby-forum.com/t/rails-3-and-html-safe/188664 "2010-05-15T22:00:08Z")\
**Posts on this page:** 5\
**Page:** 1
**Author:**  [@rob](https://www.ruby-forum.com/u/rob)\
**Post date:** [May 15, 2010, 10:00pm UTC](https://www.ruby-forum.com/t/rails-3-and-html-safe/188664/1 "2010-05-15T22:00:08Z")
Is it just me or is html\_safe a massive pain in the arse? Just trying
to do a simple helper.
def messages
messages = ‘’
[:error, :notice].each do |t|
if flash[t]
messages \<\< content\_tag(:p, flash[t], :class =\> t)
end
end
unless messages.blank?
content\_tag(:div, messages)
end
end
cause an enormous amount of aggravation. I tried for hours to try and
find why it was escaping everything.
def messages
messages = ‘’.html\_safe
[:error, :notice].each do |t|
if flash[t]
messages \<\< content\_tag(:p, flash[t].html\_safe, :class =\> t)
end
end
unless messages.blank?
content\_tag(:div, messages)
end
end
It would be nice if you could just html\_safe right at the end of the
method but oooooh no.
Discuss?
–
Rob L.
removed\_email\_address@domain.invalid
> **[Posts](https://www.robl.me/)**
>
> I write thems codes
---
**Author:**  [@rob](https://www.ruby-forum.com/u/rob)\
**Post date:** [May 17, 2010, 4:37pm UTC](https://www.ruby-forum.com/t/rails-3-and-html-safe/188664/2 "2010-05-17T16:37:16Z")
Rob L. wrote:
> Is it just me or is html\_safe a massive pain in the arse? Just trying
> to do a simple helper.
Are you having an actual problem with it, or are you just complaining?
If it’s the latter, then I’ll inject that it’s a heck of a lot less of a
pain than having to remember to wrap every potentially unsafe user input
with the “h” method. On top of being less painful, it’s also much safer
to be secure by default.
If you have any suggestions on a better implementation of html\_safe then
this is the wrong forum to make those suggestions. Instead make them to
the Rails core forum where they belong.
---
**Author:**  [@rob](https://www.ruby-forum.com/u/rob)\
**Post date:** [May 17, 2010, 5:03pm UTC](https://www.ruby-forum.com/t/rails-3-and-html-safe/188664/3 "2010-05-17T17:03:38Z")
I guess its a bit of a whinge as well as to gauge other people’s
opinions on it. Personally I haven’t used the ‘h’ method a great deal
in the past 4 years of developing with Rails, I guess because our
validation generally doesn’t allow for html being injected into our
database. But of course its always possible.
Its a tricky one as I might expect that calling html\_safe on a string
that has already been escaped because its deemed to be unsafe, would
actually unescape it again. As it stands you end up with calling
html\_safe in lots of different places on every new string that’s
introduced along the way, and therefore repeating yourself a lot.
RobL
On 17 May 2010 15:37, Robert W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> If you have any suggestions on a better implementation of html\_safe then
–
Rob L.
removed\_email\_address@domain.invalid
> **[Posts](https://www.robl.me/)**
>
> I write thems codes
---
**Author:**  [@rob](https://www.ruby-forum.com/u/rob)\
**Post date:** [May 17, 2010, 5:22pm UTC](https://www.ruby-forum.com/t/rails-3-and-html-safe/188664/4 "2010-05-17T17:22:37Z")
Rob L. wrote:
> I guess its a bit of a whinge as well as to gauge other people’s
> opinions on it. Personally I haven’t used the ‘h’ method a great deal
> in the past 4 years of developing with Rails, I guess because our
> validation generally doesn’t allow for html being injected into our
> database. But of course its always possible.
I have a feeling you’re affording yourself a lot more confidence than
deserved. Just because you haven’t been hacked yet, doesn’t mean your
system is truly secure. It more likely means that, so far, nobody has
been interested in hacking your system. Hopefully that won’t happen to
you, but if you’re not “generally” using the h method, I’m betting you
have holes in your security (well less so now that you’re moving to
Rails 3.0).
“Generally” just doesn’t cut it when it comes to security. Security is
like a chain, in that the integrity of the chain depends on its weakest
link. It doesn’t matter if you have a thousand perfectly strong links,
if just one of them is weak then your system is vulnerable.
In my opinion it is far better to default secure, and then tell the
system when you want to loosen security when necessary. This is what
html\_safe provides us.
> Its a tricky one as I might expect that calling html\_safe on a string
> that has already been escaped because its deemed to be unsafe, would
> actually unescape it again. As it stands you end up with calling
> html\_safe in lots of different places on every new string that’s
> introduced along the way, and therefore repeating yourself a lot.
Most developers will be calling html\_safe far less often than the old h
method. So I’ll gladly take that trade-off.
Also, don’t make snap judgments on an implementation such as html\_safe.
If you sure that it works the way you have described it, then fine.
Otherwise you’re just going to confuse people. I highly recommend you
find a blog written by someone who actually knows how html\_safe works. I
think you’ll be pleasantly surprised by both its function and its
implementation.
---
**Author:**  [@rob](https://www.ruby-forum.com/u/rob)\
**Post date:** [May 17, 2010, 8:11pm UTC](https://www.ruby-forum.com/t/rails-3-and-html-safe/188664/5 "2010-05-17T20:11:33Z")
Don’t think that I have written off html\_safe as worthless as I think
you might have. I see its value of course. I’m not sitting here being
cocky either. Lets just say that I’ve found using html\_safe so far to
be tricky, even it it does force me to be clear at every stage what
may or may not be harmful strings.
Its interesting to note that the solution to my problem was
messages = ‘’
messages \<\< content\_tag(:p, ‘dave’)
#=\> \dave\<\p%;gt;
message = ‘’.html\_safe
message \<\< content\_tag(:p, ‘dave’)
#=\>
dave
because an empty string is considered not to be html\_safe and
concatenating to it made the resulting string not html\_safe. My
concern was more that the original source of the unsafe html was a bit
confusing.
RobL
On 17 May 2010 16:22, Robert W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> been interested in hacking your system. Hopefully that won’t happen to
> system when you want to loosen security when necessary. This is what
>
> You received this message because you are subscribed to the Google G. “Ruby on Rails: Talk” group.
> To post to this group, send email to removed\_email\_address@domain.invalid.
> To unsubscribe from this group, send email to removed\_email\_address@domain.invalid.
> For more options, visit this group at [http://groups.google.com/group/rubyonrails-talk?hl=en](http://groups.google.com/group/rubyonrails-talk?hl=en).
–
Rob L.
removed\_email\_address@domain.invalid
> **[Posts](https://www.robl.me/)**
>
> I write thems codes