# Rails3 xss escaping

**URL:** <https://www.ruby-forum.com/t/rails3-xss-escaping/194128>\
**Category:** Rails\
**Created:** [August 30, 2010, 8:08pm UTC](https://www.ruby-forum.com/t/rails3-xss-escaping/194128 "2010-08-30T20:08:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![arvias](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ac91a4/32.png) [@arvias](https://www.ruby-forum.com/u/arvias)\
**Post date:** [August 30, 2010, 8:08pm UTC](https://www.ruby-forum.com/t/rails3-xss-escaping/194128/1 "2010-08-30T20:08:03Z")

</div>

Hi.

Is there a way to disable the default xss escaping of everything in  
rails3?

What’s the proper way of doing string concatenations like below with  
rails3 if xss escaping can not be disabled:  
“something #{link\_to(‘something else’) if value == true}”

–  
M.

---

<div class="post-metadata">

**Author:** ![arvias](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ac91a4/32.png) [@arvias](https://www.ruby-forum.com/u/arvias)\
**Post date:** [August 30, 2010, 8:45pm UTC](https://www.ruby-forum.com/t/rails3-xss-escaping/194128/2 "2010-08-30T20:45:39Z")

</div>

Marcelo B. wrote:

> Hi.
> 
> Is there a way to disable the default xss escaping of everything in  
> rails3?

I don’t know of a way to disable it entirely, that’s sort of the point.  
Safe by default.

When you want to bypass the escaping you can use to use the ‘raw’  
method:

\<%= raw my\_unsafe\_string %\>

Think of this as the opposite of the old ‘h’ method.

> What’s the proper way of doing string concatenations like below with  
> rails3 if xss escaping can not be disabled:  
> “something #{link\_to(‘something else’) if value == true}”

In helpers it’s also possible to mark the string as html\_safe:

“something #{link\_to(‘something else’) if value == true}”.html\_safe

Read this as, “I’m telling you that this is safe so don’t escape it.”