# Using user supplied string String#include? **URL:** \ **Category:** Ruby\ **Created:** [September 17, 2007, 5:53pm UTC](https://www.ruby-forum.com/t/using-user-supplied-string-string-include/114801 "2007-09-17T17:53:51Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Tobi\_R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ea666f/32.png) [@Tobi\_R](https://www.ruby-forum.com/u/Tobi_R)\ **Post date:** [September 17, 2007, 5:53pm UTC](https://www.ruby-forum.com/t/using-user-supplied-string-string-include/114801/1 "2007-09-17T17:53:51Z")
Hi In a web app that will soon be out there in the vast and partially evil web, I might take a string which a user supplied via an HTML form, and use it roughly like this: some\_str.downcase.include?(user\_supplied\_str.downcase) Would this be dangerous? Could the visitor smuggle in stuff like backticks or #{}? Should I increase $SAFE, use #taint, and filter out dangerous characters? Tobi ---
**Author:** ![Tobi\_R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ea666f/32.png) [@Tobi\_R](https://www.ruby-forum.com/u/Tobi_R)\ **Post date:** [September 17, 2007, 9:49pm UTC](https://www.ruby-forum.com/t/using-user-supplied-string-string-include/114801/2 "2007-09-17T21:49:35Z")
On 9/17/07, Tobi R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Hi > > In a web app that will soon be out there in the vast and partially > evil web, I might take a string which a user supplied via an HTML > form, and use it roughly like this: > > some\_str.downcase.include?(user\_supplied\_str.downcase) > > Would this be dangerous? Could the visitor smuggle in stuff like > backticks or #{}? No. Here it’s perfectly safe - you have to call eval to evaluate #{}, `` etc. Other dangerous actions might be “send”, “class\_eval”, … but here you are not using any of them.