# Rails 3 flash message problems

**URL:** <https://www.ruby-forum.com/t/rails-3-flash-message-problems/193397>\
**Category:** Rails\
**Created:** [August 17, 2010, 4:21am UTC](https://www.ruby-forum.com/t/rails-3-flash-message-problems/193397 "2010-08-17T04:21:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bruparel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e47774/32.png) [@bruparel](https://www.ruby-forum.com/u/bruparel)\
**Post date:** [August 17, 2010, 4:21am UTC](https://www.ruby-forum.com/t/rails-3-flash-message-problems/193397/1 "2010-08-17T04:21:07Z")

</div>

The following code in my application\_helper.rb class either eats the  
flash message or escapes it and does not display properly:

# Outputs the corresponding flash message if any are set

def flash\_messages  
messages = []  
%w(notice warning error).each do |msg|  
messages \<\< content\_tag(:div, content\_tag(:p,  
html\_escape(flash[msg.to\_sym])), :class =\> “message #{msg}”) unless  
flash[msg.to\_sym].blank?  
end  
messages  
end

I am not sure how to make it html\_safe so that Rails 3 renders it  
properly. No problems with Rails 2.3.8, but I had to mark the entire  
method “safe\_method” using rails\_xss plugin.

Is there a rule to doing this kind of view sanitization?

Thanks.

Bharat

---

<div class="post-metadata">

**Author:** ![bruparel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e47774/32.png) [@bruparel](https://www.ruby-forum.com/u/bruparel)\
**Post date:** [August 17, 2010, 4:42am UTC](https://www.ruby-forum.com/t/rails-3-flash-message-problems/193397/2 "2010-08-17T04:42:33Z")

</div>

On Mon, Aug 16, 2010 at 9:21 PM, Bharat R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> I am not sure how to make it html\_safe so that Rails 3 \> renders it properly.

Rails 3 is html safe by default. You only need to use ‘raw’ if you  
want it unsafe.

–  
Greg D.  
[destiney.com](http://destiney.com) | [gregdonald.com](http://gregdonald.com)

---

<div class="post-metadata">

**Author:** ![bruparel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e47774/32.png) [@bruparel](https://www.ruby-forum.com/u/bruparel)\
**Post date:** [August 17, 2010, 4:56am UTC](https://www.ruby-forum.com/t/rails-3-flash-message-problems/193397/3 "2010-08-17T04:56:40Z")

</div>

Sorry,  
Did not ask my question properly. You are right, Rails 3 is safe by  
default.

What I meant to ask is how do I fix the method shown above so that the  
rendered HTML is not escaped and therefore displays properly?  
Thanks.  
Bharat

---

<div class="post-metadata">

**Author:** ![bruparel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e47774/32.png) [@bruparel](https://www.ruby-forum.com/u/bruparel)\
**Post date:** [August 20, 2010, 4:59pm UTC](https://www.ruby-forum.com/t/rails-3-flash-message-problems/193397/4 "2010-08-20T16:59:43Z")

</div>

def flash\_messages  
%w(notice warning error).each do |msg|  
concat content\_tag(:div, content\_tag(:p, flash[msg.to\_sym]),  
:class =\> “message #{msg}”) unless flash[msg.to\_sym].blank?  
end  
end

in the layout: \<% flash\_messages %\>