# Script injection/cross-site scripting protection **URL:** \ **Category:** Rails\ **Created:** [July 13, 2006, 9:17pm UTC](https://www.ruby-forum.com/t/script-injection-cross-site-scripting-protection/98313 "2006-07-13T21:17:46Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [July 13, 2006, 9:17pm UTC](https://www.ruby-forum.com/t/script-injection-cross-site-scripting-protection/98313/1 "2006-07-13T21:17:46Z")
When is it possible to set as the value of project.name, what it the best way to escape the output of the following? \<%= project.name %\> Dennis Byrne ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [July 13, 2006, 9:58pm UTC](https://www.ruby-forum.com/t/script-injection-cross-site-scripting-protection/98313/2 "2006-07-13T21:58:55Z")
On 7/13/06, removed\_email\_address@domain.invalid [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > When is it possible to set as the value of > project.name, what it the best way to escape the output of the following? > > \<%= project.name %\> \<%=h project.name %\> ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [July 13, 2006, 10:02pm UTC](https://www.ruby-forum.com/t/script-injection-cross-site-scripting-protection/98313/3 "2006-07-13T22:02:22Z")
Hi Dennis, Dennis\_Byrne wrote: > When is it possible to set > as the value of project.name, Not sure I understand this. Is it something you want to do? Or something you’re trying to protect against? > what it the best way to escape the output of the following? > > \<%= project.name %\> \<%=h project.name %\> is the standard way of escaping output in Rails. hth, Bill ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [July 13, 2006, 10:14pm UTC](https://www.ruby-forum.com/t/script-injection-cross-site-scripting-protection/98313/4 "2006-07-13T22:14:20Z")
On Thursday, July 13, 2006, at 9:28 AM, wrote: > removed\_email\_address@domain.invalid > [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails) like this… \<%= h project.name %\> h() is a shortcut for html\_escape, and should be used for any text output in a view that could be malicious. I seem to recall support was added to ERB a while back to make this the default behavior. \_Kevin ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [July 13, 2006, 10:24pm UTC](https://www.ruby-forum.com/t/script-injection-cross-site-scripting-protection/98313/5 "2006-07-13T22:24:55Z")
OK, just use h. Thanks to Kevin and Bill. Dennis Byrne Kevin O. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) Sent by: removed\_email\_address@domain.invalid 07/13/2006 09:42 AM Please respond to removed\_email\_address@domain.invalid To removed\_email\_address@domain.invalid cc Subject Re: [Rails] script injection/cross-site scripting protection On Thursday, July 13, 2006, at 9:28 AM, wrote: > removed\_email\_address@domain.invalid > [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails) like this… \<%= h project.name %\> h() is a shortcut for html\_escape, and should be used for any text output in a view that could be malicious. I seem to recall support was added to ERB a while back to make this the default behavior. \_Kevin