Question

I would like for my app to allow users to post links in their posts, and for those links to automatically be recognized. To do so, I have been using auto_link as such: the following is the partial that is called to show a person’s post:

_post.html.erb:

 <tr>
     <td >
    <span class="post_header"><h4><%= link_to "#{post.user.first_name} #{post.user.last_name}", post.user %></h4></span>
    <p> <%= auto_link(post.content) %> </p>
    <span class="post_timestamp">
        Opined <%= time_ago_in_words(post.created_at) %> ago
    </span>
     </td>
 </tr>

this outputs the following, for a single post.content:

 <p> Wondering if this link &lt;a href=&quot;http://www.economist.com/blogs/freeexchange&quot;&gt;http://www.economist.com/blogs/freeexchange&lt;/a&gt; will become a proper link

Why does auto-link create/escape the angle brackets to <a etc? Is there some way to fix this, as this does not create working links. Instead the output in the browser is:

 Wondering if this link <a href="http://www.economist.com/blogs/freeexchange">http://www.economist.com/blogs/freeexchange</a> will become a proper link

Answer 1

In Rails 3, erb will default to not allow any ruby output to contain html. To get around this you can use "some string".html_safe

<%= auto_link(post.content).html_safe %>

But of course any html or javascript will then be allowed. So…

<%= sanitize(auto_link(post.content).html_safe) %>