# Securing the views

**URL:** <https://www.ruby-forum.com/t/securing-the-views/152993>\
**Category:** Rails\
**Created:** [November 10, 2008, 11:12pm UTC](https://www.ruby-forum.com/t/securing-the-views/152993 "2008-11-10T23:12:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![panatura](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a5b964/32.png) [@panatura](https://www.ruby-forum.com/u/panatura)\
**Post date:** [November 10, 2008, 11:12pm UTC](https://www.ruby-forum.com/t/securing-the-views/152993/1 "2008-11-10T23:12:27Z")

</div>

Hi,

what about writing \<%= h(@foo) %\> in the view? I heard it’s necessary  
for every information out of the database, I just couldn’t find any  
information 'bout that?

… and what about writing -%\> ? What’s that for? In which situation?

Greetings  
Mario

---

<div class="post-metadata">

**Author:** ![panatura](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a5b964/32.png) [@panatura](https://www.ruby-forum.com/u/panatura)\
**Post date:** [November 10, 2008, 11:51pm UTC](https://www.ruby-forum.com/t/securing-the-views/152993/2 "2008-11-10T23:51:15Z")

</div>

On 10 Nov 2008, at 22:12, Mario Peterscheck wrote:

> Hi,
> 
> what about writing \<%= h(@foo) %\> in the view? I heard it’s necessary  
> for every information out of the database, I just couldn’t find any  
> information 'bout that?

That escapes the text, ie \< becomes &lt and so on. If users are just  
inputting raw text this prevents against them using characters which  
have special significance whether malicious (users trying to insert  
funny tags into the page) or not (users don’t have to know about  
writing & instead of &)

> … and what about writing -%\> ? What’s that for? In which situation?

That’s to do with suppressing the empty lines you would otherwise get  
in the output for stuff like  
\<% if … %\>  
…  
\<% end %\>

---

<div class="post-metadata">

**Author:** ![panatura](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a5b964/32.png) [@panatura](https://www.ruby-forum.com/u/panatura)\
**Post date:** [November 11, 2008, 12:02am UTC](https://www.ruby-forum.com/t/securing-the-views/152993/3 "2008-11-11T00:02:22Z")

</div>

> > what about writing \<%= h(@foo) %\> in the view? I heard it’s necessary  
> > for every information out of the database, I just couldn’t find any  
> > information 'bout that?

You can also use \<%= sanitize @foo %\> that will allow only a few  
unhamrful html tags that you choose.

---

<div class="post-metadata">

**Author:** ![panatura](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a5b964/32.png) [@panatura](https://www.ruby-forum.com/u/panatura)\
**Post date:** [November 11, 2008, 12:06am UTC](https://www.ruby-forum.com/t/securing-the-views/152993/4 "2008-11-11T00:06:51Z")

</div>

Thanks guys, quick and essential. Having some work now changing some  
code 😉