method

html_safe

Ruby on Rails latest stable (v5.2.3) - 1 note - Class: String

1.0.0
1.1.6
1.2.6
2.0.3
2.1.0
2.2.1
2.3.2
2.3.8 (0)
3.0.0 (0)
3.0.9 (0)
3.1.0 (0)
3.2.1 (0)
3.2.8 (0)
3.2.13 (0)
4.0.2 (0)
4.1.8 (0)
4.2.1 (38)
4.2.7 (0)
4.2.9 (0)
5.0.0.1 (0)
5.1.7 (0)
5.2.3 (0)
6.0.0 (0)
6.1.3.1 (0)
What's this?

html_safe() public

Marks a string as trusted safe. It will be inserted into HTML with no additional escaping performed. It is your responsibility to ensure that the string contains no malicious content. This method is equivalent to the raw helper in views. It is recommended that you use sanitize instead of this method. It should never be called on user input.

Show source

# File activesupport/lib/active_support/core_ext/string/output_safety.rb, line 255
  def html_safe
    ActiveSupport::SafeBuffer.new(self)
  end

October 20, 2010

7 thanks

use raw() instead

Don’t use this method unless you’re sure your string isn’t nil. Instead use the raw() method, which wont raise an exception on nil.

html_safe

Related methods

use raw() instead

Flowdock - Team Inbox With Chat for Software Developers