开发者

Rails 3 HTML Injection

开发者 https://www.devze.com 2023-04-08 11:28 出处:网络
Currently following the Learning Rails Screencasts at http://www.buildingwebapps.com/learningrails, making any necessary changes to work in Rails 3. However, in the tenth episode, I\'m having a proble

Currently following the Learning Rails Screencasts at http://www.buildingwebapps.com/learningrails, making any necessary changes to work in Rails 3. However, in the tenth episode, I'm having a problem when rendering html code out of the database. The Page model in the tutorial has a body field, where the html of each page is put. The viewer controller's 'show' method grabs a Page from the database, and yields the contents of @page.body into the view. However, instead of rendering tags such as h1 properly, when I view the html source in the browser my tags are being render开发者_如何学Ced as <h1;@gt. Is there any way I can fix this?

Just for reference, my 'show' view is as follows:

<%= @page.body %>


Try this:

<%= raw(@page.body) %>

Raw method prevents escaping HTML characters.

0

精彩评论

暂无评论...
验证码 换一张
取 消

关注公众号