SanitizeHelper
The SanitizeHelper methods
support a variety of approaches to escaping HTML and CSS. They
complement the h method (short for
html_escape, part of the ERb:Util class) by providing other approaches
to escaping markup or letting it pass:
sanitizeThe
sanitizemethod provides a customizable approach to removing attributes and markup that you don’t want to pass through. The customization can be specified through the:tagsand:attributesparameters, or set by default through initializer code.sanitize_cssThe
sanitize_cssmethod removes features from CSS that the creators ofsanitizefelt were too dangerous. This is used bysanitizeon style attributes.strip_linksThe
strip_linksmethod leaves markup other than links intact, but removes all links from the argument.strip_tagsThe
strip_tagsmethod removes all HTML markup from the argument. (The documentation warns that it may not always find all HTML markup, however.)
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access