Prevent HTML escaping in a text area

Question

Realized that if I put HTML code in a rails text area, it will output the html.

For instance:

<b> Hello </b>

outputs as:

Hello

I thought rails 3 text inputs automatically escape HTML but whenever I output @variable.textarea, it still shows the bold text. Is it being selective about what HTML to input? And how do I make sure all HTML is always escape when I output the content of my textarea?

Thanks!

Answer 1

If <b>hello</b> comes out as hello, that means HTML escaping is already prevented.

Since you don't want users to be able to use HTML in their inputs, you want HTML to be escaped, so that <b>hello</b> comes out as <b>hello</b>.

In a Rails 3 app, html automatically gets escaped - but you can explicitly escape it using the h method:

<%= h my_string %>