Question

I’ve been following the Rails 3 Getting Started guide and there was this note in the guide that I didn’t understand:

In previous versions of Rails, you had to use <%=h post.name %> so
that any HTML would be escaped before being inserted into the page. In
Rails 3.0, this is now the default. To get unescaped HTML, you now use
<%= raw post.name %>.

I don’t really get what it means by escaped HTML vs unescaped HTML. Can someone explain this to me?

Thanks!

Answer 1

If post.name = <b>Bob</b>

then Escaped HTML will show

<b>Bob</b>

While Unescaped HTML will show raw output

Bob