# Rails 3 safe strings

**URL:** <https://www.ruby-forum.com/t/rails-3-safe-strings/192953>\
**Category:** Rails\
**Created:** [August 9, 2010, 4:22am UTC](https://www.ruby-forum.com/t/rails-3-safe-strings/192953 "2010-08-09T04:22:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bruparel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e47774/32.png) [@bruparel](https://www.ruby-forum.com/u/bruparel)\
**Post date:** [August 9, 2010, 4:22am UTC](https://www.ruby-forum.com/t/rails-3-safe-strings/192953/1 "2010-08-09T04:22:33Z")

</div>

I am trying to convert my Rails 2.3.5 app to 2.3.8 and then to Rails 3.0  
Currently, I am upgrading to Rails 2.3.8. The default escaping behavior  
is causing all kinds of problems.

I have installed the rails\_xss plugin from the following url:

> **[GitHub - rails/rails\_xss: A plugin for rails 2.3 apps which switches the...](https://github.com/rails/rails_xss)**
>
> A plugin for rails 2.3 apps which switches the default to escape by default - GitHub - rails/rails\_xss: A plugin for rails 2.3 apps which switches the default to escape by default

And am trying to follow the directions in readme.

I have a form builder which has the following method:

def field\_label(field\_name, \*args)  
options = args.extract\_options!  
options.reverse\_merge!(:required =\> field\_required?(field\_name))  
options[:label\_class] = “required” if options[:required]  
t\_label = options.delete(:label)  
t\_label = (t\_label.nil? ? field\_name.to\_s.humanize.titleize :  
t\_label)  
if object.errors.invalid? field\_name  
temp\_label = t\_label + ": " +  
@template.content\_tag(:span,  
([object.errors.on(field\_name)].flatten.first.sub(/^^/, ‘’)), :class =\>  
‘error\_message’)  
else  
temp\_label = t\_label  
end  
label(field\_name, temp\_label.html\_safe, :class =\>  
options[:label\_class])  
end

I cannot seem to get the method above not escape the error text when I  
intentionally try to submit a required field with an empty value. I get  
an output as shown below:

Client Name: can’t be blank

See if the string in the element is not being interpreted? How  
can this be done? Is there a method to this madness?

Thanks for your time.

Bharat

---

<div class="post-metadata">

**Author:** ![bruparel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e47774/32.png) [@bruparel](https://www.ruby-forum.com/u/bruparel)\
**Post date:** [August 9, 2010, 5:09am UTC](https://www.ruby-forum.com/t/rails-3-safe-strings/192953/2 "2010-08-09T05:09:42Z")

</div>

Please disregard. This was my error. I had a field\_error method in one  
of my initializer classes as shown below:

ActionView::Base.field\_error\_proc = Proc.new do |html\_tag, instance\_tag|  
if html\_tag =~ /type=“hidden”/ || html\_tag =~ /\<label/  
html\_tag  
else  
“#{html\_tag}”.html\_safe  
end  
end

I had simply forgotten to mark the return string as html\_safe.

I am going to sleep before I ask too many “dumb” questions.

Thanks.

Bharat