# Sanitizing html tags (content)

**URL:** <https://www.ruby-forum.com/t/sanitizing-html-tags-content/177739>\
**Category:** Ruby\
**Created:** [October 22, 2009, 8:03pm UTC](https://www.ruby-forum.com/t/sanitizing-html-tags-content/177739 "2009-10-22T20:03:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![introvert](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/c37758/32.png) [@introvert](https://www.ruby-forum.com/u/introvert)\
**Post date:** [October 22, 2009, 8:03pm UTC](https://www.ruby-forum.com/t/sanitizing-html-tags-content/177739/1 "2009-10-22T20:03:19Z")

</div>

Hello,

I have a variable which holds the following html code:

some textlink …

Now I’d like to process it so that everything would be stripped except  
object/param/embed tags (span tag and its content should be removed).

What is the best way to compliment that?

I’ve installed sanitize gem but it wont allow me to strip/remove content  
inside html tags as well.

I though of regex but I’m unsure about this.

Many thanks for help!

---

<div class="post-metadata">

**Author:** ![introvert](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/c37758/32.png) [@introvert](https://www.ruby-forum.com/u/introvert)\
**Post date:** [October 22, 2009, 11:15pm UTC](https://www.ruby-forum.com/t/sanitizing-html-tags-content/177739/2 "2009-10-22T23:15:39Z")

</div>

On Oct 22, 2009, at 12:03 PM, Aljaz F. wrote:

> type=“application/x-shockwave-flash” allowscriptaccess=“always”  
> content  
> inside html tags as well.
> 
> I though of regex but I’m unsure about this.
> 
> Many thanks for help!

Have a look at nokogiri. It will parse the HTML for you and you can  
then tinker with it as you please. After you’re done, just write it  
back out as a string.

Blessings,  
TwP

---

<div class="post-metadata">

**Author:** ![introvert](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/c37758/32.png) [@introvert](https://www.ruby-forum.com/u/introvert)\
**Post date:** [October 23, 2009, 1:26am UTC](https://www.ruby-forum.com/t/sanitizing-html-tags-content/177739/3 "2009-10-23T01:26:48Z")

</div>

On Thu, Oct 22, 2009 at 5:15 PM, Tim P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> > src=“[- YouTube](http://www.youtube.com/v/6fEogbKnNcQ&hl=en&fs=1&)”  
> > I’ve installed sanitize gem but it wont allow me to strip/remove content  
> > inside html tags as well.
> > 
> > I though of regex but I’m unsure about this.

Please don’t use regexes. Think of the children!

Instead, try Loofah, which is based on Nokogiri and has some nice  
sanitization helpers:

[http://loofah.rubyforge.org/](http://loofah.rubyforge.org/)

Good luck!
