# Sanitize: Is it a bug?

**URL:** <https://www.ruby-forum.com/t/sanitize-is-it-a-bug/116607>\
**Category:** Rails\
**Created:** [October 7, 2007, 11:04pm UTC](https://www.ruby-forum.com/t/sanitize-is-it-a-bug/116607 "2007-10-07T23:04:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mix](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@mix](https://www.ruby-forum.com/u/mix)\
**Post date:** [October 7, 2007, 11:04pm UTC](https://www.ruby-forum.com/t/sanitize-is-it-a-bug/116607/1 "2007-10-07T23:04:25Z")

</div>

Hi, i was trying something to upload using an area text which the data  
will be shown as html using the sanitize method.  
Everything ok, about scripts, but when i tried it  
escaped the \<  
Why this? Is it a bug of sanitize? I knew that an html comment it’s just  
a comment, so why escape it? And if it isn’t a bug, is it possible to  
don’t escape the \< ? Or is it safer to escape it? why?  
Thanks

---

<div class="post-metadata">

**Author:** ![mix](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@mix](https://www.ruby-forum.com/u/mix)\
**Post date:** [October 8, 2007, 12:48pm UTC](https://www.ruby-forum.com/t/sanitize-is-it-a-bug/116607/2 "2007-10-08T12:48:52Z")

</div>

Mix M. wrote:

> Hi, i was trying something to upload using an area text which the data  
> will be shown as html using the sanitize method.  
> Everything ok, about scripts, but when i tried it  
> escaped the \<  
> Why this? Is it a bug of sanitize? I knew that an html comment it’s just  
> a comment, so why escape it? And if it isn’t a bug, is it possible to  
> don’t escape the \< ? Or is it safer to escape it? why?

sanitize doesn’t know about HTML semantics or tags. It just knows about  
HTML characters, and so it happily goes about encoding your lesser-than  
sign.

It’s proper behavior too, because you generally don’t want people to  
embed hidden HTML. You want to output everything they put into that  
textarea.

–  
Roderick van Domburg  
[http://www.nedforce.com](http://www.nedforce.com)

---

<div class="post-metadata">

**Author:** ![mix](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@mix](https://www.ruby-forum.com/u/mix)\
**Post date:** [October 8, 2007, 2:33pm UTC](https://www.ruby-forum.com/t/sanitize-is-it-a-bug/116607/3 "2007-10-08T14:33:37Z")

</div>

Roderick van Domburg wrote:

> sanitize doesn’t know about HTML semantics or tags. It just knows about  
> HTML characters, and so it happily goes about encoding your lesser-than  
> sign.
> 
> It’s proper behavior too, because you generally don’t want people to  
> embed hidden HTML. You want to output everything they put into that  
> textarea.
> 
> –  
> Roderick van Domburg  
> [http://www.nedforce.com](http://www.nedforce.com)

Mmm…ok, and what if i want to hide that comments? Is it possible to  
add to sanitize the rule to skip them?  
In the api there is this: You can modify what gets sanitized by defining  
VERBOTEN\_TAGS and VERBOTEN\_ATTRS before this Module is loaded.  
And nothing else…

---

<div class="post-metadata">

**Author:** ![mix](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@mix](https://www.ruby-forum.com/u/mix)\
**Post date:** [October 8, 2007, 2:48pm UTC](https://www.ruby-forum.com/t/sanitize-is-it-a-bug/116607/4 "2007-10-08T14:48:52Z")

</div>

Mix M. wrote:

> Roderick van Domburg wrote:
> 
> > sanitize doesn’t know about HTML semantics or tags. It just knows about  
> > HTML characters, and so it happily goes about encoding your lesser-than  
> > sign.
> > 
> > It’s proper behavior too, because you generally don’t want people to  
> > embed hidden HTML. You want to output everything they put into that  
> > textarea.
> 
> Mmm…ok, and what if i want to hide that comments? Is it possible to  
> add to sanitize the rule to skip them?  
> In the api there is this: You can modify what gets sanitized by defining  
> VERBOTEN\_TAGS and VERBOTEN\_ATTRS before this Module is loaded.  
> And nothing else…

No, sanitize can’t do that for you. You’d need to write a custom  
sanitizer, splitting the input, keeping your comments, and sanitizing  
the rest possibly using Rails’ default sanitizer.

–  
Roderick van Domburg  
[http://www.nedforce.com](http://www.nedforce.com)

---

<div class="post-metadata">

**Author:** ![mix](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@mix](https://www.ruby-forum.com/u/mix)\
**Post date:** [October 8, 2007, 2:55pm UTC](https://www.ruby-forum.com/t/sanitize-is-it-a-bug/116607/5 "2007-10-08T14:55:54Z")

</div>

Roderick van Domburg wrote:

> No, sanitize can’t do that for you. You’d need to write a custom  
> sanitizer, splitting the input, keeping your comments, and sanitizing  
> the rest possibly using Rails’ default sanitizer.
> 
> –  
> Roderick van Domburg  
> [http://www.nedforce.com](http://www.nedforce.com)

mmm… ok, so i think that it’s better to do something directly in the  
model like

def before\_save  
self.text = self.text.gbus(//, ‘’)  
end

it should work… 🙂