# Textile and h problems

**URL:** <https://www.ruby-forum.com/t/textile-and-h-problems/157481>\
**Category:** Rails\
**Created:** [January 12, 2009, 5:21am UTC](https://www.ruby-forum.com/t/textile-and-h-problems/157481 "2009-01-12T05:21:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mikec](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/977dab/32.png) [@mikec](https://www.ruby-forum.com/u/mikec)\
**Post date:** [January 12, 2009, 5:21am UTC](https://www.ruby-forum.com/t/textile-and-h-problems/157481/1 "2009-01-12T05:21:19Z")

</div>

I installed Redcloth into my app so that it could use Textile.  
However, it seems that textilize (the function used to parse the  
Textile stuff) and h aren’t compatible. If I do \<%= textilize h  
@mymessage %\> it doesn’t work. If I take out the h it works but then I  
leave myself open to XSS. Is there a way to get around this?  
Essentially I was trying to allow users to do basic HTML functions and  
weed out javascript.

---

<div class="post-metadata">

**Author:** ![mikec](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/977dab/32.png) [@mikec](https://www.ruby-forum.com/u/mikec)\
**Post date:** [January 12, 2009, 5:59am UTC](https://www.ruby-forum.com/t/textile-and-h-problems/157481/2 "2009-01-12T05:59:53Z")

</div>

## h(textilize(@mymessage))

Ryan B.  
Freelancer

> **[frozenplague.net](http://frozenplague.net)**
>
> This domain may be for sale!

---

<div class="post-metadata">

**Author:** ![mikec](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/977dab/32.png) [@mikec](https://www.ruby-forum.com/u/mikec)\
**Post date:** [January 12, 2009, 6:36am UTC](https://www.ruby-forum.com/t/textile-and-h-problems/157481/3 "2009-01-12T06:36:42Z")

</div>

That doesn’t work since textilize parses it into html and then h will,  
of course, take those away. Anyways I found a solution to my problem.  
It seems that you shouldn’t use textilize but just use RedCloth.new  
(message, [:filter\_html])