如何检查模型/控制器中的表单输入是否包含 HTML（垃圾邮件）？正则表达式？
我的应用程序每天收到大约 1000 个垃圾邮件条目。内容没有链接到任何地方，因此机器人的努力完全没有用。
但它扰乱了我们的指标并产生了大量的编码错误（机器人正在提交中文字符）。
这些字段是简单的文本框和输入字段。
我想做的是禁止任何在该字段中输入 html 并提交的用户。
我可以轻松处理禁止方面（注销它们，将布尔值放入用户表中）。
但我不确定如何检查参数是否包含 html 以及检查这一点的最干净的地方是......（在过滤器之前？模型验证？）。
My app is getting about 1000 spam entries a day. The content is not linked anywhere so the bots effort is completely useless.
But its messing with our metrics and generating tons of encoding errors (the bot is submitting chinese characters).
The fields are simple text boxes and input fields.
What I'd like to do is ban any user who enters html into the field and submits it.
I can handle the banning aspect (logout them out, put boolean in users table) easily.
But I'm not sure how to check if the params contain html and where the cleanest place to check for this is... (before filter? model validation?).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您始终可以使用正则表达式从输入中过滤掉 html，例如删除 之间的任何内容。和> 。
或检查是否匹配：（如果您想检测输入中是否有 HTML）
您可以将其放入控制器中，这样它会在发布后立即清理输入，或者您可以将其放入验证中，因此保存时会失败。在控制器中可能更好。
但这只能让您到目前为止 - 例如，那些机器人可能仍然会继续发布表单.. 这会耗尽您的资源..
这就是为什么我还建议您使用 Google 的 re-captcha ，它添加到 Rails 中确实很容易。
使用验证码，您将确保只有人类才能在您的网站上发帖。
http://www.google.com/recaptcha
您可以查看一些示例代码来了解如何将 ReCaptcha 集成到 Rails 项目中：
https://github.com/tilo/mail_form_example_with_recaptcha
you can always use a regexp to filter out html from input, e.g. delete anything between < and > .
or check if this matches: (if you want to detect if there was HTML in the input)
You could put this in the controller, so it cleans up the input right after it was posted, or you could put this in the validation, so it will fail on save.. Probably better in the controller.
But this will only get you so far - e.g. those bots may still keep posting forms.. which uses up resources on your end..
That's why I'd also recommend you use Google's re-captcha , which is really easy to add to Rails.
With the Captcha, you'll make sure that only humans can post to your site.
http://www.google.com/recaptcha
You can look at some example code for how to integrate ReCaptcha into a Rails project here:
https://github.com/tilo/mail_form_example_with_recaptcha
如果没有理由 <或
<只需检查尖括号。如果有一个合法的理由，它会更令人恼火，但可能仍然仅限于检查尖括号和任何您试图避免的标签。If there's no reason for a < or
<just check for angle brackets. If there is a legitimate reason, it'll be a bit more irritating, but probably still limited to checking for angle brackets and any of whatever tags you're trying to avoid.