Script injection/cross-site scripting protection

unknown · July 13, 2006, 9:17pm

When is it possible to set as the value
of
project.name, what it the best way to escape the output of the
following?

<%= project.name %>

Dennis Byrne

unknown · July 13, 2006, 9:58pm

On 7/13/06, [email protected] [email protected] wrote:

When is it possible to set as the value of
project.name, what it the best way to escape the output of the following?
<%= project.name %>

<%=h project.name %>

unknown · July 13, 2006, 10:02pm

Hi Dennis,

Dennis_Byrne wrote:

When is it possible to set
as the value of project.name,

Not sure I understand this. Is it something you want to do? Or
something
you’re trying to protect against?

what it the best way to escape the output of the following?
<%= project.name %>

<%=h project.name %> is the standard way of escaping output in Rails.

hth,
Bill

unknown · July 13, 2006, 10:14pm

On Thursday, July 13, 2006, at 9:28 AM, wrote:

[email protected]
http://lists.rubyonrails.org/mailman/listinfo/rails

like this…

<%= h project.name %>

h() is a shortcut for html_escape, and should be used for any text
output in a view that could be malicious. I seem to recall support was
added to ERB a while back to make this the default behavior.

_Kevin

unknown · July 13, 2006, 10:24pm

OK, just use h. Thanks to Kevin and Bill.