# What escape or sanitize functions are out there?

**URL:** <https://www.ruby-forum.com/t/what-escape-or-sanitize-functions-are-out-there/166191>\
**Category:** Rails\
**Created:** [April 22, 2009, 5:27pm UTC](https://www.ruby-forum.com/t/what-escape-or-sanitize-functions-are-out-there/166191 "2009-04-22T17:27:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![winterheat](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7993a0/32.png) [@winterheat](https://www.ruby-forum.com/u/winterheat)\
**Post date:** [April 22, 2009, 5:27pm UTC](https://www.ruby-forum.com/t/what-escape-or-sanitize-functions-are-out-there/166191/1 "2009-04-22T17:27:26Z")

</div>

i found the following functions or method to escape HTML, URL params, or  
Javascript data:

\<%= h @ha %\>  
\<%= sanitize @ha %\>  
\<%= u @ha %\>  
\<%= @ha.to\_json %\>  
\<%= strip\_tags @ha %\>

are they more functions or methods to do these things?

and are there alternative ways to do that? thanks.

---

<div class="post-metadata">

**Author:** ![winterheat](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7993a0/32.png) [@winterheat](https://www.ruby-forum.com/u/winterheat)\
**Post date:** [April 22, 2009, 11:06pm UTC](https://www.ruby-forum.com/t/what-escape-or-sanitize-functions-are-out-there/166191/2 "2009-04-22T23:06:41Z")

</div>

i have been using the xss\_terminate plugin:

> **[GitHub - look/xss\_terminate: xss\_terminate is a plugin in that makes stripping...](https://github.com/look/xss_terminate/tree/master)**
>
> master

basically it sanitizes values before they are stored in the database:

“Installing the plugin creates a +before\_save+ hook that will strip HTML  
tags  
from all string and text fields. No further configuration is necessary  
if this  
is what you want. To customize the behavior, you use the +xss\_terminate+  
class  
method.”

---

<div class="post-metadata">

**Author:** ![winterheat](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7993a0/32.png) [@winterheat](https://www.ruby-forum.com/u/winterheat)\
**Post date:** [April 22, 2009, 11:10pm UTC](https://www.ruby-forum.com/t/what-escape-or-sanitize-functions-are-out-there/166191/3 "2009-04-22T23:10:25Z")

</div>

PP Junty wrote:

> i have been using the xss\_terminate plugin:
> 
> [GitHub - look/xss\_terminate: xss\_terminate is a plugin in that makes stripping and sanitizing HTML stupid-simple. Install and forget. And forget about forgetting to h() your output, because you won‘t need to anymore.](http://github.com/look/xss_terminate/tree/master)
> 
> basically it sanitizes values before they are stored in the database:
> 
> “Installing the plugin creates a +before\_save+ hook that will strip HTML  
> tags  
> from all string and text fields. No further configuration is necessary  
> if this  
> is what you want. To customize the behavior, you use the +xss\_terminate+  
> class  
> method.”

somebody also suggested replacing all “\<” with "\< " and seems like it  
can be a very rude form of preventing malicious code? thanks.