Question

I have a model with a title field. When I post to the server I see:

Parameters: {"utf8"=>"✓", "authenticity_token"=>"3Le7aLitPd6MzWFeB0ofI9wk1IuhybNswjG9N+KgJJc=", "poll"=>{"title"=>"Hello &"}}

Problem is the DB is then saving as:

Hello &

So later when I output the field on the site it shows up as Hello &

What is the right way to handle this? I want entering & to be supported but at the same time not allow users to submit html or js tags.

Thanks

Answer 1

Sanitize.clean outputs HTML, not plain text so of course your ampersands are converted to their HTML entity form (i.e. &). For example, straight from the the fine manual:

Sanitize.clean(html, Sanitize::Config::RESTRICTED) # => '<b>foo</b>'

So you are, in fact, store HTML snippets rather than pieces of plain text. You should be using

<%= raw @thing.title %>

to display your titles as they have already been rendered HTML-safe by Sanitize.