# Security issue in app

**URL:** <https://www.ruby-forum.com/t/security-issue-in-app/220372>\
**Category:** Rails\
**Created:** [April 5, 2010, 12:11pm UTC](https://www.ruby-forum.com/t/security-issue-in-app/220372 "2010-04-05T12:11:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\
**Post date:** [April 5, 2010, 12:11pm UTC](https://www.ruby-forum.com/t/security-issue-in-app/220372/1 "2010-04-05T12:11:59Z")

</div>

Hi,  
I am facing a following problem:-  
I have app in which user can edit his/her personal information and we  
are showing it on browser. Some of users has added  
“” javascript in name textbox. Due to  
this whenever I am showing name on browser it is executing the script  
and giving javascript alert.  
Can anyone tell me how to fix this? Is there any plugin avaliable?

Thanks,  
Tushar

---

<div class="post-metadata">

**Author:** ![gandhi-tush](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/5daacb/32.png) [@gandhi-tush](https://www.ruby-forum.com/u/gandhi-tush)\
**Post date:** [April 5, 2010, 12:55pm UTC](https://www.ruby-forum.com/t/security-issue-in-app/220372/2 "2010-04-05T12:55:08Z")

</div>

\<%=h @text\_from\_user %\>

The point is ‘h’ helper.  
[Getting Started with Rails — Ruby on Rails Guides](http://guides.rubyonrails.org/getting_started.html) - will be very  
useful to read.  
Good luck.

---

<div class="post-metadata">

**Author:** ![gandhi-tush](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/5daacb/32.png) [@gandhi-tush](https://www.ruby-forum.com/u/gandhi-tush)\
**Post date:** [April 5, 2010, 1:20pm UTC](https://www.ruby-forum.com/t/security-issue-in-app/220372/3 "2010-04-05T13:20:55Z")

</div>

Hi,  
Use rails HTML escaping method - html\_escape(s) or h(s) to fix that  
issue.

Thanks,  
Priyanka P.

---

<div class="post-metadata">

**Author:** ![gandhi-tush](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/5daacb/32.png) [@gandhi-tush](https://www.ruby-forum.com/u/gandhi-tush)\
**Post date:** [April 5, 2010, 1:36pm UTC](https://www.ruby-forum.com/t/security-issue-in-app/220372/4 "2010-04-05T13:36:52Z")

</div>

Thanks Priyanka  
It is working.  
Priyanka P. wrote:

> Hi,  
> Use rails HTML escaping method - html\_escape(s) or h(s) to fix that  
> issue.
> 
> Thanks,  
> Priyanka P.