Ruby Sanitize Code ... why and sanitized

Question

I am currently using the following code to sanitize a string before saving it:

ERB::Util::h(string)

My problem occurs when the line has already been cleared as follows:

string = "Watching baseball `&` football"

The sanitized line will look like this:

sanitized_string = "Watching baseball `&` football"

Can I sanitize by simply turning <in <and> in >by substitution?

Answer 1

Uncheck the box first, then run again:

require 'cgi'
string = "Watching baseball & football"

CGI.escapeHTML(CGI.unescapeHTML(string))

=> "Watching baseball & football"

Answer 2

A quick approach based on this snippet from Erubis .

ESCAPE_TABLE = { '<'=>'&lt;', '>'=>'&gt;' }
def custom_h(value)
   value.to_s.gsub(/[<>]/) { |s| ESCAPE_TABLE[s] }
end

Answer 3

, , , :

mystring.gsub( /<(.|\n)*?>/, '' )

Answer 4

, .

A better approach might be to unencode your string before disinfecting it - h () has an inverse that you could wrap your lines in the first place?