# Using \ in a text field **URL:** \ **Category:** Rails\ **Created:** [August 17, 2010, 5:18pm UTC](https://www.ruby-forum.com/t/using-a-href-in-a-text-field/193434 "2010-08-17T17:18:12Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![kaspir](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/3ab097/32.png) [@kaspir](https://www.ruby-forum.com/u/kaspir)\ **Post date:** [August 17, 2010, 5:18pm UTC](https://www.ruby-forum.com/t/using-a-href-in-a-text-field/193434/1 "2010-08-17T17:18:12Z")
If this is a really stupid noob question I apologize in advance, and appreciate any answers I get from this. I made a blog with rails, and just finished with the design. Upon creating my first real post, I realized I couldn’t put links in my posts. I mean I can write links yes, but what I want to do is this: ```auto blah blah blah site blah blah blah ``` So I really have no idea what to do. I googled html filters, url filters, and url parsers for about an hour before I posted this, so any information would be helpful. Thanks 😃 ---
**Author:** ![kaspir](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/3ab097/32.png) [@kaspir](https://www.ruby-forum.com/u/kaspir)\ **Post date:** [August 17, 2010, 5:26pm UTC](https://www.ruby-forum.com/t/using-a-href-in-a-text-field/193434/2 "2010-08-17T17:26:36Z")
On Tue, Aug 17, 2010 at 11:18, Kaspir G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I couldn’t put links in my > posts. I mean I can write links yes, but what I want to do is this: > > ```auto > blah blah blah site blah blah blah > ``` Looks to me like you’re running afoul of HTML sanitization. This is in fact for your (or rather, your users’) protection, against cross-site-scripting attacks. If you REALLY want to do that sort of thing, you can explicitly mark the string as being already HTML-safe. I’ll leave it to you to find out how to do that, as this is a serious vulnerability, not to be left unprotected-against lightly. Alternately, there are probably some plugins/gems/whatever that will let your users insert a _limited subset_ of tags, including links… though of course the targets may contain cross-site-scripting attacks… -Dave – Specialization is for insects. -RAH | Have Pun, Will Babble! -me Programming Blog: [http://codosaur.us](http://codosaur.us) | Work: [http://davearonson.com](http://davearonson.com) Leadership Blog: [http://dare2xl.com](http://dare2xl.com) | Play: [http://davearonson.net](http://davearonson.net) - - - - - WATCH THIS SPACE \* \* \* \* \* | Ruby: [http://mars.groupsite.com](http://mars.groupsite.com) ---
**Author:** ![kaspir](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/3ab097/32.png) [@kaspir](https://www.ruby-forum.com/u/kaspir)\ **Post date:** [August 17, 2010, 5:32pm UTC](https://www.ruby-forum.com/t/using-a-href-in-a-text-field/193434/3 "2010-08-17T17:32:28Z")
On 17 August 2010 16:18, Kaspir G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > So I really have no idea what to do. I googled html filters, url > filters, and url parsers for about an hour before I posted this, so any > information would be helpful. Thanks 😃 Do you mean that you want the poster to be able to type \ **Author:** ![kaspir](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/3ab097/32.png) [@kaspir](https://www.ruby-forum.com/u/kaspir)\ **Post date:** [August 17, 2010, 5:45pm UTC](https://www.ruby-forum.com/t/using-a-href-in-a-text-field/193434/4 "2010-08-17T17:45:21Z") On Tue, Aug 17, 2010 at 11:32, Kaspir G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I am the only user on the site. Does either option still present a > threat for me? If you allow people to comment, then their comments must likewise be sanitized. If you do not, then that is an indirect hazard to you – allowing common attack vectors like XSS vulnerabilities to go unaddressed, is hazardous to your professional reputation. 🙂 IOW, don’t just do it because of any direct immediate threat to you. Do it because it’s The Right Thing To Do. -Dave – Specialization is for insects. -RAH | Have Pun, Will Babble! -me Programming Blog: [http://codosaur.us](http://codosaur.us) | Work: [http://davearonson.com](http://davearonson.com) Leadership Blog: [http://dare2xl.com](http://dare2xl.com) | Play: [http://davearonson.net](http://davearonson.net) - - - - - WATCH THIS SPACE \* \* \* \* \* | Ruby: [http://mars.groupsite.com](http://mars.groupsite.com) ---
**Author:** ![kaspir](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/3ab097/32.png) [@kaspir](https://www.ruby-forum.com/u/kaspir)\ **Post date:** [August 17, 2010, 5:32pm UTC](https://www.ruby-forum.com/t/using-a-href-in-a-text-field/193434/5 "2010-08-17T17:32:49Z")
Dave A. wrote: > On Tue, Aug 17, 2010 at 11:18, Kaspir G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > wrote: > > > I couldn’t put links in my > > posts. I mean I can write links yes, but what I want to do is this: > > > > ```auto > > blah blah blah site blah blah blah > > ``` > > Looks to me like you’re running afoul of HTML sanitization. This is > in fact for your (or rather, your users’) protection, against > cross-site-scripting attacks. If you REALLY want to do that sort of > thing, you can explicitly mark the string as being already HTML-safe. > I’ll leave it to you to find out how to do that, as this is a serious > vulnerability, not to be left unprotected-against lightly. > > Alternately, there are probably some plugins/gems/whatever that will > let your users insert a _limited subset_ of tags, including links… > though of course the targets may contain cross-site-scripting > attacks… > > -Dave Thanks for your reply! I am the only user on the site. Does either option still present a threat for me? > – > Specialization is for insects. -RAH �| Have Pun, Will Babble! -me > Programming Blog: [http://codosaur.us](http://codosaur.us) | Work: [http://davearonson.com](http://davearonson.com) > Leadership Blog: �[http://dare2xl.com](http://dare2xl.com) | Play: [http://davearonson.net](http://davearonson.net) > > - > - > - > - > - WATCH THIS SPACE \* \* \* \* \* | Ruby: [http://mars.groupsite.com](http://mars.groupsite.com)