# Textile/RedCloth and h() incompatible?

**URL:** <https://www.ruby-forum.com/t/textile-redcloth-and-h-incompatible/60255>\
**Category:** Rails\
**Created:** [May 11, 2006, 5:19pm UTC](https://www.ruby-forum.com/t/textile-redcloth-and-h-incompatible/60255 "2006-05-11T17:19:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lindsay\_B](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/ecae2f/32.png) [@Lindsay\_B](https://www.ruby-forum.com/u/Lindsay_B)\
**Post date:** [May 11, 2006, 5:19pm UTC](https://www.ruby-forum.com/t/textile-redcloth-and-h-incompatible/60255/1 "2006-05-11T17:19:55Z")

</div>

If a user enters the Textile-based code for an image, say:

!\>graphic.png!

the textile() method will successfully render a right-float image. Now,  
if I want to escape the user’s text using h(), the ‘\>’ is turned into an  
&. Obviously, the image then fails to render in a browser. Is there  
a work around for this?

I guess what I’m really asking is: is there a way to allow the user to  
have limited ability to embed HTML in a view, and can Textile still be  
used as a friendly way to encode the HTML?

-Lindsay

---

<div class="post-metadata">

**Author:** ![Lindsay\_B](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/ecae2f/32.png) [@Lindsay\_B](https://www.ruby-forum.com/u/Lindsay_B)\
**Post date:** [May 11, 2006, 8:18pm UTC](https://www.ruby-forum.com/t/textile-redcloth-and-h-incompatible/60255/2 "2006-05-11T20:18:54Z")

</div>

i believe redcloth will sanitize for you (if i recall correctly) so  
you don’t need h(). You may have to pass a flag, but the source  
should make it clear.

pt.

pt.

On 5/11/06, Lindsay B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> have limited ability to embed HTML in a view, and can Textile still be

–  
Parker T.  
[http://www.parkert.com/](http://www.parkert.com/)  
510.541.0125

---

<div class="post-metadata">

**Author:** ![Lindsay\_B](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/ecae2f/32.png) [@Lindsay\_B](https://www.ruby-forum.com/u/Lindsay_B)\
**Post date:** [May 11, 2006, 9:00pm UTC](https://www.ruby-forum.com/t/textile-redcloth-and-h-incompatible/60255/3 "2006-05-11T21:00:00Z")

</div>

Parker T. wrote:

> i believe redcloth will sanitize for you

Thanks for the heads up! I’ll check the source.

---

<div class="post-metadata">

**Author:** ![Lindsay\_B](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/ecae2f/32.png) [@Lindsay\_B](https://www.ruby-forum.com/u/Lindsay_B)\
**Post date:** [May 11, 2006, 10:58pm UTC](https://www.ruby-forum.com/t/textile-redcloth-and-h-incompatible/60255/4 "2006-05-11T22:58:27Z")

</div>

can you do this?  
mytext = “\<%= @user.find(3)” #someone’s string trying to hack you.  
mytext = h(“mytext”) #not sure if thats how you call it in controller  
or if you can  
mytext = Redcloth.new mytext  
mytext = mytext.to\_html