Securing the views

rubyonrails-talk
1

Hi,

what about writing <%= h(@foo) %> in the view? I heard it's necessary for every information out of the database, I just couldn't find any information 'bout that?

... and what about writing -%> ? What's that for? In which situation?

Greetings Mario

2

Hi,

what about writing <%= h(@foo) %> in the view? I heard it's necessary for every information out of the database, I just couldn't find any information 'bout that?

That escapes the text, ie < becomes &lt and so on. If users are just
inputting raw text this prevents against them using characters which
have special significance whether malicious (users trying to insert
funny tags into the page) or not (users don't have to know about
writing &amp; instead of &)

... and what about writing -%> ? What's that for? In which situation?

That's to do with suppressing the empty lines you would otherwise get
in the output for stuff like <% if ... %>   ... <% end %>

3

what about writing <%= h(@foo) %> in the view? I heard it's necessary for every information out of the database, I just couldn't find any information 'bout that?

You can also use <%= sanitize @foo %> that will allow only a few unhamrful html tags that you choose.

4

Thanks guys, quick and essential. Having some work now changing some code :wink: