\
**Category:** rubyonrails-talk\
**Created:** [May 15, 2008, 9:16am UTC](https://discuss.rubyonrails.org/t/help-rails-html-sanitizer-to-remove-html-tags/29410 "2008-05-15T09:16:07Z")\
**Posts on this page:** 6\
**Page:** 1
**Author:**  [@JON14](https://discuss.rubyonrails.org/u/JON14)\
**Post date:** [May 15, 2008, 9:16am UTC](https://discuss.rubyonrails.org/t/help-rails-html-sanitizer-to-remove-html-tags/29410/1 "2008-05-15T09:16:07Z")
HI, I am new to rails and lately was introduced to FCK editor for formatting text. Do you have any idea about how can we sanitize strings. I am using FCK editor for my text areas but because of that the data in the database is completely filled with HTML tags used for formatting the data/. eg: \\ text \\ etc...
But I need to show the formatted text at some instances whereas normal text at other instances. Do let me know if we can somehow sanitize the text and strip off the html tags from it.
Thanx a lot JON
---
**Author:**  [@Raveendran\_P](https://discuss.rubyonrails.org/u/Raveendran_P)\
**Post date:** [May 15, 2008, 9:23am UTC](https://discuss.rubyonrails.org/t/help-rails-html-sanitizer-to-remove-html-tags/29410/2 "2008-05-15T09:23:28Z")
Hi,
Hpricot is a very flexible HTML parser, based on Tanaka Akira’s [HTree](http://www.a-k-r.org/htree/) and John Resig’s [JQuery](http://jquery.com/), but with the scanner recoded in C (using [Ragel](http://www.cs.queensu.ca/%7Ethurston/ragel/) for scanning.) I’ve borrowed what I believe to be the best ideas from these wares to make Hpricot heaps of fun to use.
## Installing [Hpricot](http://localhost:8808/doc_root/hpricot-0.6-mswin32/rdoc/classes/Hpricot.html)
You may get the latest stable version from Rubyforge. Win32 binaries and source gems are available.
```ruby
$ gem install hpricot
```
As [Hpricot](http://localhost:8808/doc_root/hpricot-0.6-mswin32/rdoc/classes/Hpricot.html) is still under active development, you can also try the most recent candidate build here:
```ruby
$ gem install hpricot --source [http://code.whytheluckystiff.net](http://code.whytheluckystiff.net)
```
The development gem is usually in pretty good shape actually. You can also get the bleeding edge code or plain Ruby tarballs on the wiki.
For more Details:
Please see the link
[http://code.whytheluckystiff.net/hpricot/](http://code.whytheluckystiff.net/hpricot/)
---
**Author:**  [@Ivor\_Paul](https://discuss.rubyonrails.org/u/Ivor_Paul)\
**Post date:** [May 15, 2008, 9:36am UTC](https://discuss.rubyonrails.org/t/help-rails-html-sanitizer-to-remove-html-tags/29410/3 "2008-05-15T09:36:55Z")
If I remember correctly, the acts\_as\_textiled plugin lets you show textiled text without the tags, or with - based on parameters passed.
In my experience editors like fck cause more problems than they solve - textile is a lot better behaved. However, it obviously depends on your needs.
Regards Ivor
---
**Author:**  [@ChrisMDP](https://discuss.rubyonrails.org/u/ChrisMDP)\
**Post date:** [May 15, 2008, 9:53am UTC](https://discuss.rubyonrails.org/t/help-rails-html-sanitizer-to-remove-html-tags/29410/4 "2008-05-15T09:53:38Z")
I'd try asking on Ruby on Rails: Talk for this sort of thing.
[http://groups.google.com/group/rubyonrails-talk](http://groups.google.com/group/rubyonrails-talk)
---
**Author:**  [@Peter\_De\_Berdt](https://discuss.rubyonrails.org/u/Peter_De_Berdt)\
**Post date:** [May 15, 2008, 10:01am UTC](https://discuss.rubyonrails.org/t/help-rails-html-sanitizer-to-remove-html-tags/29410/5 "2008-05-15T10:01:23Z")
It would be nice if you didn’t crosspost on the Prototype/scripaculous list, because that’s not the appropriate place for it.
You can use strip\_tags in your view to strip out all the tags. Quite logical, as was to be expected by the Rails framework and Ruby in general.
Best regards
Peter De Berdt
---
**Author:**  [@Jonathan\_Fantham](https://discuss.rubyonrails.org/u/Jonathan_Fantham)\
**Post date:** [May 16, 2008, 12:09am UTC](https://discuss.rubyonrails.org/t/help-rails-html-sanitizer-to-remove-html-tags/29410/6 "2008-05-16T00:09:44Z")
you should look at the white\_list plugin if you're using an older version of rails though, strip\_tags wasn't really that secure till 2.0
[http://svn.techno-weenie.net/projects/plugins/white\_list/](http://svn.techno-weenie.net/projects/plugins/white_list/)[http://www.rorsecurity.info/2007/08/17/dont-use-strip\_tags-strip\_links-and-sanitize/](http://www.rorsecurity.info/2007/08/17/dont-use-strip_tags-strip_links-and-sanitize/)