Avoid html_safe with Tag Helpers, safe_join, and sanitize

This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.

When you need to build HTML outside of a template, it’s tempting to concatenate strings and call html_safe on the result. This bypasses Rails’s built-in XSS protection entirely: any user input in that string goes straight to the browser unescaped. The good news is you almost never need html_safe . Rails provides three underappreciated tools that handle escaping for you. Instead of… …calling…

Read on andycroll.com ↗