\
**Category:** Rails\
**Created:** [October 15, 2007, 7:22pm UTC](https://www.ruby-forum.com/t/sanitizing-html-in-a-model/117293 "2007-10-15T19:22:10Z")\
**Posts on this page:** 9\
**Page:** 1
**Author:**  [@fxp](https://www.ruby-forum.com/u/fxp)\
**Post date:** [October 15, 2007, 7:22pm UTC](https://www.ruby-forum.com/t/sanitizing-html-in-a-model/117293/1 "2007-10-15T19:22:10Z")
I’m making a messaging application and am wondering if there’s a way to
do HTML sanitization in the model instead of in the view. My application
accepts a message from the user, which must then be sanitized before
it’s posted. I know that I can do \<%=h %\> in the view, or use
sanitize(), but I would like to do it before the record is even saved as
I figured it’s better to fix the problem right at the beginning. Is
there a way to do the equivalent of =h in a Model?
---
**Author:**  [@fxp](https://www.ruby-forum.com/u/fxp)\
**Post date:** [October 15, 2007, 7:35pm UTC](https://www.ruby-forum.com/t/sanitizing-html-in-a-model/117293/2 "2007-10-15T19:35:17Z")
On Mon, 2007-10-15 at 19:22 +0200, Christopher B. wrote:
> I’m making a messaging application and am wondering if there’s a way to
> do HTML sanitization in the model instead of in the view. My application
> accepts a message from the user, which must then be sanitized before
> it’s posted. I know that I can do \<%=h %\> in the view, or use
> sanitize(), but I would like to do it before the record is even saved as
> I figured it’s better to fix the problem right at the beginning. Is
> there a way to do the equivalent of =h in a Model?
h() is just “html string”.gsub(‘&’, ‘&’).gsub(‘\<’, ‘\<’).gsub(‘\>’,
‘\>’).gsub(‘"’, ‘"’)
Although I would actually stick to using \<%=h instead of putting
sanitised data in the database… What if you change your mind about
sanitising, or want to display data differently based on the type of
user (html for admin, h-ed for everyone else)?
–
Tore D.
removed\_email\_address@domain.invalid
Trondheim, NO
[http://tore.darell.no/](http://tore.darell.no/)
---
**Author:**  [@fxp](https://www.ruby-forum.com/u/fxp)\
**Post date:** [October 15, 2007, 11:42pm UTC](https://www.ruby-forum.com/t/sanitizing-html-in-a-model/117293/3 "2007-10-15T23:42:06Z")
This plugin [http://www.railslodge.com/plugins/112-text-formatter](http://www.railslodge.com/plugins/112-text-formatter) should
do what you require.
Christopher B. wrote:
> I’m making a messaging application and am wondering if there’s a way to
> do HTML sanitization in the model instead of in the view. My application
> accepts a message from the user, which must then be sanitized before
> it’s posted. I know that I can do \<%=h %\> in the view, or use
> sanitize(), but I would like to do it before the record is even saved as
> I figured it’s better to fix the problem right at the beginning. Is
> there a way to do the equivalent of =h in a Model?
---
**Author:**  [@fxp](https://www.ruby-forum.com/u/fxp)\
**Post date:** [October 16, 2007, 12:10am UTC](https://www.ruby-forum.com/t/sanitizing-html-in-a-model/117293/4 "2007-10-16T00:10:02Z")
Two points:
Remember to sanitize EVERYTHING, either when you store it (by
disallowing certain characters, say in a username) or when you display
it (using h(), \<%=h … %\> or whatever you choose.)
I personally use a script that will disallow tags, and
Javascript URIs in links, etc. It uses an allow list, not a disallow
list, so new exploits should be detected more easily than with a
filter.
–Michael
---
**Author:**  [@fxp](https://www.ruby-forum.com/u/fxp)\
**Post date:** [October 16, 2007, 12:59am UTC](https://www.ruby-forum.com/t/sanitizing-html-in-a-model/117293/5 "2007-10-16T00:59:43Z")
I suggest you take a peek at:
[http://golem.ph.utexas.edu/~distler/blog/archives/001181.html](http://golem.ph.utexas.edu/~distler/blog/archives/001181.html)
---
**Author:**  [@fxp](https://www.ruby-forum.com/u/fxp)\
**Post date:** [October 16, 2007, 12:44am UTC](https://www.ruby-forum.com/t/sanitizing-html-in-a-model/117293/6 "2007-10-16T00:44:21Z")
Thanks for the suggestions. I just discovered the CGI.escapeHTML()
function. Would that be a workable alternative to writing my own
function or using the plug in listed above?
---
**Author:**  [@fxp](https://www.ruby-forum.com/u/fxp)\
**Post date:** [October 16, 2007, 11:53am UTC](https://www.ruby-forum.com/t/sanitizing-html-in-a-model/117293/7 "2007-10-16T11:53:53Z")
Christopher B. wrote:
> Thanks for the suggestions. I just discovered the CGI.escapeHTML()
> function. Would that be a workable alternative to writing my own
> function or using the plug in listed above?
chris -
precisely.
---
**Author:**  [@fxp](https://www.ruby-forum.com/u/fxp)\
**Post date:** [October 16, 2007, 11:55am UTC](https://www.ruby-forum.com/t/sanitizing-html-in-a-model/117293/8 "2007-10-16T11:55:12Z")
Shai R. wrote:
> Christopher B. wrote:
>
> > Thanks for the suggestions. I just discovered the CGI.escapeHTML()
> > function. Would that be a workable alternative to writing my own
> > function or using the plug in listed above?
>
> chris -
>
> precisely.
i did the exact same thing, saving the title in an before\_save call:
```
before_save :securetitle
def securetitle
self.title = CGI.escapeHTML(self.title)
end
```
---
**Author:**  [@fxp](https://www.ruby-forum.com/u/fxp)\
**Post date:** [October 16, 2007, 12:16pm UTC](https://www.ruby-forum.com/t/sanitizing-html-in-a-model/117293/9 "2007-10-16T12:16:26Z")
class Article \< ActiveRecord::Base
include ActionView::Helpers::SanitizeHelper
def before\_create
self.description = sanitize(self.description)
end
end
That’s how I do it. This will be using Rails 2.0’s whitelist sanitize
helper.
On 10/15/07, Christopher B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)
wrote:
> >
–
Cheers!
- Pratik
[http://m.onkey.org](http://m.onkey.org)