PHP HTMLPurifier 库，但用于 Rails？
任何使用 PHP 做过大量工作并从 TinyMCE 之类的东西接收富文本输入的人（可能）都使用过类似 HTMLPurifier 的东西避免在您故意允许用户提交的 HTML 中出现令人讨厌的内容。
例如，HTMLPurifier 将采用一串（可能格式错误的）HTML 并删除不允许的元素和属性，尝试修复损坏的 HTML，并在某些情况下将 等内容转换为 。
Rails (3) 是否存在等效的东西？在 Rails 中清理富文本编辑器输入的普遍接受的方法是什么，以便您可以将未转义的 HTML 输出到网页上，并了解诸如
编辑|有人用过Sanitize吗？任何其他选项与专业人士和;骗局？
Anyone who's done anything much with PHP and receiving rich-text input from something like TinyMCE has (probably) used something like HTMLPurifier to keep the nasties out of the HTML you're intentionally allowing the user to submit.
For example, HTMLPurifier will take a string of (potentially malformed) HTML and strip out disallowed elements and attributes, try to fix broken HTML, and in some cases convert things like <i> to <em>.
Does anything equivalent exist for Rails (3)? What's the generally accepted way to sanitize input from rich text editors in Rails so that you can output the unescaped HTML onto a web page and know that stuff like <style> and <script> tags have been taken out of it and it's not going to break your page (or steal your cookies!)?
EDIT | Anybody used Sanitize? Any other options with pro's & con's?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以使用清理方法。
还有一个 Sanitize 宝石。
我倾向于更喜欢 Sanitize gem，因为它可以用作模型中的 before_save 过滤器，而不必在每个视图中使用 sanitize 方法。
You can use the sanitize method.
There is also a Sanitize gem.
I tend to prefer the Sanitize gem because it can be used as a before_save filter in your models instead of having to use the sanitize method in each of your views.