# Sanitize\_params + whiteList

**URL:** <https://www.ruby-forum.com/t/sanitize-params-whitelist/166962>\
**Category:** Rails\
**Created:** [May 1, 2009, 2:26pm UTC](https://www.ruby-forum.com/t/sanitize-params-whitelist/166962 "2009-05-01T14:26:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![petan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/c57346/32.png) [@petan](https://www.ruby-forum.com/u/petan)\
**Post date:** [May 1, 2009, 2:26pm UTC](https://www.ruby-forum.com/t/sanitize-params-whitelist/166962/1 "2009-05-01T14:26:09Z")

</div>

Hi all,

I just installed whiteList and sanitize\_params plugins to get rid of  
with some bad html tags …

Put in my environment.rb:  
config.plugins = [:white\_list, :sanitize\_params, :all]

and in application.rb:  
before\_filter :sanitize\_params

add ok tags to config/initializers/whitelist\_conf.rb  
WhiteListHelper.tags += %w(a em p strong blockquote h2 ul li)

but all the tags from the text fields are stripped. Am I missing  
something?  
THx P.

---

<div class="post-metadata">

**Author:** ![petan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/c57346/32.png) [@petan](https://www.ruby-forum.com/u/petan)\
**Post date:** [May 7, 2009, 9:49pm UTC](https://www.ruby-forum.com/t/sanitize-params-whitelist/166962/2 "2009-05-07T21:49:50Z")

</div>

Anyone?

---

<div class="post-metadata">

**Author:** ![petan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/c57346/32.png) [@petan](https://www.ruby-forum.com/u/petan)\
**Post date:** [May 7, 2009, 10:30pm UTC](https://www.ruby-forum.com/t/sanitize-params-whitelist/166962/3 "2009-05-07T22:30:55Z")

</div>

hi,  
what about to put

WhiteListHelper.tags += %w(a em p strong blockquote h2 ul li)

into app/helpers/application\_helper.rb ?

instead of config/…

tom

Petan C. wrote:

> add ok tags to config/initializers/whitelist\_conf.rb  
> WhiteListHelper.tags += %w(a em p strong blockquote h2 ul li)
> 
> but all the tags from the text fields are stripped. Am I missing  
> something?  
> THx P.

# –

Tomas Meinlschmidt, MS {MCT, MCP+I, MCSE, AER}, NetApp Filer/NetCache

# [www.meinlschmidt.com](http://www.meinlschmidt.com) www.maxwellrender.cz www.lightgems.cz

---

<div class="post-metadata">

**Author:** ![petan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/c57346/32.png) [@petan](https://www.ruby-forum.com/u/petan)\
**Post date:** [May 8, 2009, 9:41am UTC](https://www.ruby-forum.com/t/sanitize-params-whitelist/166962/4 "2009-05-08T09:41:01Z")

</div>

Hi Tom,

I’ve moved the whitelistHelper tag to application\_helper.rb, but it  
still strips all the tags. ☹

Thx, Pete

Tom Z Meinlschmidt wrote:

> hi,  
> what about to put
> 
> WhiteListHelper.tags += %w(a em p strong blockquote h2 ul li)
> 
> into app/helpers/application\_helper.rb ?
> 
> instead of config/…
> 
> tom