# Security question - erb (erubis)

**URL:** <https://www.ruby-forum.com/t/security-question-erb-erubis/125348>\
**Category:** Rails\
**Created:** [January 8, 2008, 1:25pm UTC](https://www.ruby-forum.com/t/security-question-erb-erubis/125348 "2008-01-08T13:25:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![goodieboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecc23a/32.png) [@goodieboy](https://www.ruby-forum.com/u/goodieboy)\
**Post date:** [January 8, 2008, 1:25pm UTC](https://www.ruby-forum.com/t/security-question-erb-erubis/125348/1 "2008-01-08T13:25:36Z")

</div>

Hi,

I’m tinkering with the idea of providing a client of mine with the  
ability to edit pages, using erb. I’ve setup a couple of nice helpers  
and things actually work surprisingly well. I’m using render\_to\_string  
mainly.

Questions:

Does this seem totally insane, even if my client and I are the only  
onces editing the pages?

Is it possible to limit what classes and methods are called within a  
template?

Does anyone know of a set of regexp’s that would filter out nasty  
things like bacticks etc.?

Thank you!

Matt