Question

I’m using Rails 3.1 and I need to save unescaped HTML entered in a form, but I can’t figure out how to disable the escape by default. In my form I have

<%= form_for(:post, :url=>{:action => 'create'}) do |f| %>              
    <%= f.text_field :title %>      
    <%= f.text_area :body %>        
    <%= submit_tag "Publish", :id=>"submit", :class => "cta" %>             
<% end %>

and in my controller:

def create   
    @post = Post.new(params[:post])   
    if @post.save      
      redirect_to(:action => 'overview')
    else     
      render('new')
    end
end

I’ve tried :escape => false in the form, and raw() in the controller but nothing works. How do I save the entered data as unescaped HTML?

Thanks for your help!

Answer 1

You may use the raw command to get the pure HTML, because Rails > 3 by default escape HTML:

<%= raw method_return_html_code %>

and if you are allowing users to enter text with HTML markup, like blog posts, have a look at the CKEditor gem which will give you a nice text area to do your HTML markups (like in Gmail, Yahoo, etc…)