RHTML displaying HTML tags in output

Question

I have an RHTML view in Rails where the output comes from my MongoDB collection. The data is displayed correctly using an iteration block, but whenever I try to use HTML tags in my database, they are not displayed in the HTML output, but only displayed.

<%
 @posts.find().each do |post|
%>
 <h1><%=post["name"]%></h1>
 <p><%=post["body"] %></p>
 <p><%=post["timestamp"]%></p>
<%
 end
%>

But for example, if I had

<p>Test</p>

In my database, tags will be displayed instead of printing. A.

Answer 1

This is a security protection that is now built into Rails 3. It prevents problems with XSS (cross-site scripting).

If you add raw, you will get the desired result.

<% @posts.each do |post| %> 
 <h1><%=raw post["name"]%></h1> 
 <p><%=raw post["body"] %></p> 
 <p><%=raw post["timestamp"]%></p> 
<% end %> 

, HTML-, , , .

Edit:

: raw, sanitize helper. <%=sanitize post["name"], :tags => "p" %>, <p>.

Answer 2

raw .html_safe, 100% , sanitize, .

<% = sanitize post [ "name" ] $ >

. http://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html