Question

I’ve created an iFrame component for people to integrate into their websites. The iFrame needs to be passed a GET variable from the URL string when the page is loaded on the remote site. In this case, the parent page would be called as http://www.theirsite.com/tracking=12345 and the tracking variable should be written into the html code on the remote page for the iframe when the page is rendered.

I’ve created versions of the code for each major language except rails. The PHP version of the code is shown below.

As a complete Rails neophyte, I’m hoping someone can generate a similar code snippet for Rails with XSS protection similar to htmlentities().

I publish the code for people to grab and copy into their sites.

... src="mysite.com?tracking=<?php echo htmlentities($_GET['tracking']); ?>" ...

Answer 1

The params hash contains a collection of all GET and POST variables:

... src="mysite.com?tracking=<%= CGI::escape(params[:tracking]) %>" ...

The CGI:escape() function encodes the parameter for a URL and may help prevent XSS attacks.