raw vs. html_safe vs. h to unescape html

I think it bears repeating: html_safe does not HTML-escape your string. In fact, it will prevent your string from being escaped.

<%= "<script>alert('Hello!')</script>" %>

will put:

<script>alert('Hello!')</script>

into your HTML source (yay, so safe!), while:

<%= "<script>alert('Hello!')</script>".html_safe %>

will pop up the alert dialog (are you sure that’s what you want?). So you probably don’t want to call html_safe on any user-entered strings.

The difference is between Rails’ html_safe() and raw(). There is an excellent post by Yehuda Katz on this, and it really boils down to this:

def raw(stringish)

  stringish.to_s.html_safe

end

Yes, raw() is a wrapper around html_safe() that forces the input to String and then calls html_safe() on it. It’s also the case that raw() is a helper in a module whereas html_safe() is a method on the String class which makes a new ActiveSupport::SafeBuffer instance — that has a @dirty flag in it.

Refer to “Rails’ html_safe vs. raw“.

1. html_safe :

   Marks a string as trusted safe. It will be inserted into HTML with no additional escaping performed.

   "<a>Hello</a>".html_safe
   #=> "<a>Hello</a>"
   
   nil.html_safe
   #=> NoMethodError: undefined method `html_safe' for nil:NilClass
   

2. raw :

   raw is just a wrapper around html_safe. Use raw if there are chances that the string will be nil.

   raw("<a>Hello</a>")
   #=> "<a>Hello</a>"
   
   raw(nil)
   #=> ""
   

3. h alias for html_escape :

   A utility method for escaping HTML tag characters. Use this method to escape any unsafe content.

   In Rails 3 and above it is used by default so you don’t need to use this method explicitly

The best safe way is: <%= sanitize @x %>

It will avoid XSS!

In Simple Rails terms:

h remove html tags into number characters so that rendering won’t break your html

html_safe sets a boolean in string so that the string is considered as html save

raw It converts to html_safe to string

Short and Simple

Let’s assume we can’t trust user input.

Bad:

user_input.html_safe # asking for trouble

Good:

user_input.html_escape # or

h(user_input) # in some view

Inputs we control:

trusted_input_only.html_safe

that should be fine. but be careful what your trusted inputs are. They must only be generated from your app.