# What's wrong with textilize?

**URL:** <https://www.ruby-forum.com/t/whats-wrong-with-textilize/76630>\
**Category:** Rails\
**Created:** [November 20, 2006, 2:46pm UTC](https://www.ruby-forum.com/t/whats-wrong-with-textilize/76630 "2006-11-20T14:46:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ssk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/82dd89/32.png) [@ssk](https://www.ruby-forum.com/u/ssk)\
**Post date:** [November 20, 2006, 2:46pm UTC](https://www.ruby-forum.com/t/whats-wrong-with-textilize/76630/1 "2006-11-20T14:46:47Z")

</div>

Hi,

I’ve just finished reading “Beginning Ruby on Rails E-Commerce”…  
phew…  
On page 398, it says:

Caution: Although textilize is a cool quick-and-dirty helper, as a rule  
of thumb, it should never be used in a production setting.

Why?  
And what’s the alternative?

Thanks.

Sam

---

<div class="post-metadata">

**Author:** ![ssk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/82dd89/32.png) [@ssk](https://www.ruby-forum.com/u/ssk)\
**Post date:** [November 20, 2006, 11:06pm UTC](https://www.ruby-forum.com/t/whats-wrong-with-textilize/76630/2 "2006-11-20T23:06:31Z")

</div>

Sam,

I can’t speak for the author but I’ve been under the impression that  
textilize alone wasn’t considered secure. I’ve been given the  
impression that alone textilize doesn’t clean text quite like sanitize  
does.

I suspect that a textilize and sanitize solution would be safe.

Textilize alone may be open to some javascript hacks. I’m not certain  
on this. Can anyone confirm or refute?

Carl

---

<div class="post-metadata">

**Author:** ![ssk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/82dd89/32.png) [@ssk](https://www.ruby-forum.com/u/ssk)\
**Post date:** [November 20, 2006, 11:19pm UTC](https://www.ruby-forum.com/t/whats-wrong-with-textilize/76630/3 "2006-11-20T23:19:38Z")

</div>

Dupe.

[http://www.ruby-forum.com/topic/88338#168117](http://www.ruby-forum.com/topic/88338#168117)

Did you not get the answers you needed in your original posting?

-DJCP

---

<div class="post-metadata">

**Author:** ![ssk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/82dd89/32.png) [@ssk](https://www.ruby-forum.com/u/ssk)\
**Post date:** [December 4, 2006, 12:51pm UTC](https://www.ruby-forum.com/t/whats-wrong-with-textilize/76630/4 "2006-12-04T12:51:02Z")

</div>

Jarkko L. wrote:

> Hi Sam,
> 
> The same page presents the alternative: do the textilization when the  
> object is saved and save the textilized output in the database. That  
> way you just output straight html and avoid using the textilize helper  
> in the display phase.

Hi Jarkko,

You’re one of the authors of the book, right?  
Thank you very much for the answer.  
Now I know what the caution means.  
textilize methos in itself is ok.  
But it should be used when saving in DB not as a help in the view.

Regards,  
Sam

---

<div class="post-metadata">

**Author:** ![ssk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/82dd89/32.png) [@ssk](https://www.ruby-forum.com/u/ssk)\
**Post date:** [December 4, 2006, 10:52am UTC](https://www.ruby-forum.com/t/whats-wrong-with-textilize/76630/5 "2006-12-04T10:52:48Z")

</div>

ssk wrote:

> I’ve just finished reading “Beginning Ruby on Rails E-Commerce”…  
> phew…  
> On page 398, it says:
> 
> Caution: Although textilize is a cool quick-and-dirty helper, as a rule  
> of thumb, it should never be used in a production setting.
> 
> Why?  
> And what’s the alternative?

Hi Sam,

The same page presents the alternative: do the textilization when the  
object is saved and save the textilized output in the database. That  
way you just output straight html and avoid using the textilize helper  
in the display phase.