# What characters need to be escaped?

**URL:** <https://www.ruby-forum.com/t/what-characters-need-to-be-escaped/187227>\
**Category:** Rails\
**Created:** [April 20, 2010, 6:34am UTC](https://www.ruby-forum.com/t/what-characters-need-to-be-escaped/187227 "2010-04-20T06:34:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![GoodGets](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/439d5e/32.png) [@GoodGets](https://www.ruby-forum.com/u/GoodGets)\
**Post date:** [April 20, 2010, 6:34am UTC](https://www.ruby-forum.com/t/what-characters-need-to-be-escaped/187227/1 "2010-04-20T06:34:55Z")

</div>

Obviously, less and greater than’s (\< \>) need to be escaped to prevent  
XSS, but what are the other potentially harmful characters?

---

<div class="post-metadata">

**Author:** ![GoodGets](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/439d5e/32.png) [@GoodGets](https://www.ruby-forum.com/u/GoodGets)\
**Post date:** [April 20, 2010, 7:45am UTC](https://www.ruby-forum.com/t/what-characters-need-to-be-escaped/187227/2 "2010-04-20T07:45:44Z")

</div>

im curious about this also due to letting users enter some html data,  
but not harmful scripts