# Sanitize() AND escapeHTML()/h()?

**URL:** <https://www.ruby-forum.com/t/sanitize-and-escapehtml-h/171567>\
**Category:** Rails\
**Created:** [July 5, 2009, 7:26pm UTC](https://www.ruby-forum.com/t/sanitize-and-escapehtml-h/171567 "2009-07-05T19:26:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tharrisx](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e19adc/32.png) [@tharrisx](https://www.ruby-forum.com/u/tharrisx)\
**Post date:** [July 5, 2009, 7:26pm UTC](https://www.ruby-forum.com/t/sanitize-and-escapehtml-h/171567/1 "2009-07-05T19:26:36Z")

</div>

Hi there,

is it correct that one should always use both…

1. 

sanitize(params[:whatever\_external\_or\_user\_input\_to\_save\_to\_database]),  
AND  
2. h(@whatever\_database\_record\_to\_display\_on\_page)

…in order to have the highest security level? (Besides all the other  
security stuff to do, of course)

Thanks a lot!  
Tom

---

<div class="post-metadata">

**Author:** ![tharrisx](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e19adc/32.png) [@tharrisx](https://www.ruby-forum.com/u/tharrisx)\
**Post date:** [July 5, 2009, 7:38pm UTC](https://www.ruby-forum.com/t/sanitize-and-escapehtml-h/171567/2 "2009-07-05T19:38:28Z")

</div>

Tom Ha wrote:

> Hi there,
> 
> is it correct that one should always use both…
> 
> 1. 
> 
> sanitize(params[:whatever\_external\_or\_user\_input\_to\_save\_to\_database]),  
> AND  
> 2. h(@whatever\_database\_record\_to\_display\_on\_page)
> 
> …in order to have the highest security level?

AFAIK, sanitize should not be necessary – ActiveRecord uses  
parameterized queries, which already protect against SQL injection  
without further sanitization. (If you write your own SQL, your queries  
should also be parameterized.). h, on the other hand, is not about  
security so much as it is about keeping markup valid and correct. You  
should definitely use it on anything that comes from the DB, unless  
you’re deliberately storing HTML code in there.

BTW, if you use Haml (highly recommended), it has a very useful  
shorthand construct for this (&= instead of h), and you can even turn on  
HTML escaping as a global default.

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![tharrisx](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e19adc/32.png) [@tharrisx](https://www.ruby-forum.com/u/tharrisx)\
**Post date:** [July 6, 2009, 11:44am UTC](https://www.ruby-forum.com/t/sanitize-and-escapehtml-h/171567/3 "2009-07-06T11:44:25Z")

</div>

Great, thanks a lot!