# Using ERb with $SAFE=4

**URL:** <https://www.ruby-forum.com/t/using-erb-with-safe-4/90921>\
**Category:** Ruby\
**Created:** [April 3, 2007, 12:48am UTC](https://www.ruby-forum.com/t/using-erb-with-safe-4/90921 "2007-04-03T00:48:58Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andy\_Morrow](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/df705f/32.png) [@Andy\_Morrow](https://www.ruby-forum.com/u/Andy_Morrow)\
**Post date:** [April 3, 2007, 12:48am UTC](https://www.ruby-forum.com/t/using-erb-with-safe-4/90921/1 "2007-04-03T00:48:58Z")

</div>

I’m trying to use ERb to evaluate a template written by end users in  
a Rails application I’m writing. Here’s my code:

require ‘erb’  
template = “\<%= ‘Testing 1 2 3…’ %\>”.taint #because it will be user  
input in the final app  
e = ERB.new(template, 4)  
m = e.run  
puts m

Here’s what I get:  
/usr/local/lib/ruby/1.8/erb.rb:739:in `eval': Insecure: can't modify trusted binding (SecurityError) from /usr/local/lib/ruby/1.8/erb.rb:741:in`value’  
from /usr/local/lib/ruby/1.8/erb.rb:741:in `result' from /usr/local/lib/ruby/1.8/erb.rb:724:in`run’  
from tester.rb:4

What am I doing wrong?  
Thanks,  
Andy Morrow