\
**Category:** Rails\
**Created:** [September 21, 2006, 5:00pm UTC](https://www.ruby-forum.com/t/why-escape-html-in-the-view/69533 "2006-09-21T17:00:18Z")\
**Posts on this page:** 9\
**Page:** 1
**Author:**  [@elliterate](https://www.ruby-forum.com/u/elliterate)\
**Post date:** [September 21, 2006, 5:00pm UTC](https://www.ruby-forum.com/t/why-escape-html-in-the-view/69533/1 "2006-09-21T17:00:18Z")
Hey,
I don’t understand why Rails seems to mandate escaping HTML in the view
rather than when it’s inserted into the database. I cringe when I think
about all those needlessly repeated function calls.
What’s the deal?
---
**Author:**  [@elliterate](https://www.ruby-forum.com/u/elliterate)\
**Post date:** [September 21, 2006, 5:12pm UTC](https://www.ruby-forum.com/t/why-escape-html-in-the-view/69533/2 "2006-09-21T17:12:19Z")
Why don’t just escape it when it is inserted then? Overload the
accessor to process the strings in the model.
-carl
---
**Author:**  [@elliterate](https://www.ruby-forum.com/u/elliterate)\
**Post date:** [September 21, 2006, 7:00pm UTC](https://www.ruby-forum.com/t/why-escape-html-in-the-view/69533/3 "2006-09-21T19:00:42Z")
Ian L. wrote:
> I don’t understand why Rails seems to mandate escaping HTML in the view
> rather than when it’s inserted into the database. I cringe when I think
> about all those needlessly repeated function calls.
To make sure that nothing in the database, whether it was inserted by
your application or not, will break your views.
– Marcus
---
**Author:**  [@elliterate](https://www.ruby-forum.com/u/elliterate)\
**Post date:** [September 21, 2006, 7:34pm UTC](https://www.ruby-forum.com/t/why-escape-html-in-the-view/69533/4 "2006-09-21T19:34:51Z")
On 9/21/06, Marcus B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> > I don’t understand why Rails seems to mandate escaping HTML in the view
> > rather than when it’s inserted into the database. I cringe when I think
> > about all those needlessly repeated function calls.
>
> To make sure that nothing in the database, whether it was inserted by
> your application or not, will break your views.
Of course, Rails opinion is that it is the only thing touching the
database. I’d say the reason you would want it in plain text in the
database by default is that you wouldn’t necessarily always be
outputing HTML. If you never plan on needing anything other than the
HTML output, than by all means, store HTML in the database. However,
in most cases, doing so from the start would be a premature
optimization.
Jeremy
---
**Author:**  [@elliterate](https://www.ruby-forum.com/u/elliterate)\
**Post date:** [September 22, 2006, 2:37pm UTC](https://www.ruby-forum.com/t/why-escape-html-in-the-view/69533/5 "2006-09-22T14:37:08Z")
@Ian
I don’t believe that Rails _mandates_ that you escape your characters.
Only
the default scaffolding does that. It’s a good idea to do it because it
allows you to be flexible.
Of course, it would be a fun excercise to makes an acts\_as\_sanitized
plugin
that would sanitize the data coming in to the model. Should be pretty
easy
to do too… it might be a good excercise for someone wanting to write
his
or her first plugin.
---
**Author:**  [@elliterate](https://www.ruby-forum.com/u/elliterate)\
**Post date:** [September 22, 2006, 3:33pm UTC](https://www.ruby-forum.com/t/why-escape-html-in-the-view/69533/6 "2006-09-22T15:33:16Z")
Ian L. wrote:
> Hey,
>
> I don’t understand why Rails seems to mandate escaping HTML in the view
> rather than when it’s inserted into the database. I cringe when I think
> about all those needlessly repeated function calls.
>
> What’s the deal?
Because HTML escaping is part of the process of presenting the
information as HTML. There may be other ways of getting to the data,
e.g. via a web service or in a CSV report.
regards
Justin
---
**Author:**  [@elliterate](https://www.ruby-forum.com/u/elliterate)\
**Post date:** [September 22, 2006, 5:11pm UTC](https://www.ruby-forum.com/t/why-escape-html-in-the-view/69533/7 "2006-09-22T17:11:39Z")
Brian H. wrote:
> Of course, it would be a fun excercise to makes an acts\_as\_sanitized
> plugin that would sanitize the data coming in to the model. Should be
> pretty easy to do too… it might be a good excercise for someone
> wanting to write his or her first plugin.
Here’s one I prepared earlier:
[http://groups.google.com/group/rubyonrails-core/msg/61913e7144507590](http://groups.google.com/group/rubyonrails-core/msg/61913e7144507590)
–
We develop, watch us RoR, in numbers too big to ignore.
---
**Author:**  [@elliterate](https://www.ruby-forum.com/u/elliterate)\
**Post date:** [September 22, 2006, 5:31pm UTC](https://www.ruby-forum.com/t/why-escape-html-in-the-view/69533/8 "2006-09-22T17:31:42Z")
On Thu, Sep 21, 2006 at 03:54:13PM +0100, Ian L. wrote:
> Hey,
>
> I don’t understand why Rails seems to mandate escaping HTML in the view
> rather than when it’s inserted into the database. I cringe when I think
> about all those needlessly repeated function calls.
>
> What’s the deal?
Because you’re not storing HTML, you’re storing text. HTML is one
possible (albeit likely) presentation format. Other people may want to
work with your data, though, outside of a web browser.
Store text, and run it through “h” when you need to show it in a
browser.
## Michael
Michael Darrin Chaney
removed\_email\_address@domain.invalid
[http://www.michaelchaney.com/](http://www.michaelchaney.com/)
---
**Author:**  [@elliterate](https://www.ruby-forum.com/u/elliterate)\
**Post date:** [September 22, 2006, 3:31pm UTC](https://www.ruby-forum.com/t/why-escape-html-in-the-view/69533/9 "2006-09-22T15:31:16Z")
I hadn’t taken into consideration media types other than HTML, and I do
plan
to output XML at some point.
I agree with Jeremy that it’s a premature optimization, I’ll reassess
the
issue in the future.
Thanks for pointing me in the right direction.