blocks|key|1594554|text|h辅助方法：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1594555|<%25=h+"+will+be+preserved"+%25>|code-block|syntax|javascript|1594556|entityMap^0|0|1|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@$9|N|A|O|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|P|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|Q|8|@]|D|@]|E|$]]]|L|$]]

The <code>h</code> helper method:

<pre><code>&lt;%=h "&lt;p&gt; will be preserved" %&gt;
</code></pre>

blocks|key|1379560|text|签出Ruby+CGI类。有一些方法可以对HTML和URL进行编码和解码。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1379561|CGI::escapeHTML('Usage:+foo+"bar"+<baz>')
#+=>+"Usage:+foo+&quot;bar&quot;+&lt;baz&gt;"|code-block|syntax|javascript|1379562|entityMap|0|LINK|mutability|MUTABLE|url|http://ruby-doc.org/stdlib/libdoc/cgi/rdoc/classes/CGI.html#M000067^0|7|3|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@$A|R|B|S|1|T]]|C|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|C|$G|H]]|$1|I|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|J|$K|$5|L|M|N|C|$O|P]]]]

Checkout the Ruby <a href="http://ruby-doc.org/stdlib/libdoc/cgi/rdoc/classes/CGI.html#M000067">CGI</a> class. There are methods to encode and decode HTML as well as URLs.

<pre><code>CGI::escapeHTML('Usage: foo "bar" &lt;baz&gt;')
# =&gt; "Usage: foo &amp;quot;bar&amp;quot; &amp;lt;baz&amp;gt;"
</code></pre>

blocks|key|1594772|text|在Ruby+on+Rails+3中，HTML将在默认情况下转义。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1594773|对于非转义字符串，请使用：|1594774|<%25=+raw+"hello+world!"+%25>|code-block|syntax|javascript|1594775|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|L|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|M|8|@]|9|@]|A|$G|H]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

In Ruby on Rails 3 HTML will be escaped by default. 

For non-escaped strings use:

<pre><code>&lt;%= raw "&lt;p&gt;hello world!&lt;/p&gt;" %&gt;
</code></pre>

blocks|key|1594996|text|ERB::Util.html_escape可以在任何地方使用。它不需要在Rails中使用require就可以使用。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1594997|entityMap|0|LINK|mutability|MUTABLE|url|http://api.rubyonrails.org/classes/ERB/Util.html#method-c-html_escape^0|18|7|0|L|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@$9|O|A|P|B|C]]|D|@$9|Q|A|R|1|S]]|E|$]]|$1|F|3|-4|5|6|7|T|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]]]

<a href="http://api.rubyonrails.org/classes/ERB/Util.html#method-c-html_escape" rel="noreferrer">ERB::Util.html_escape</a> can be used anywhere. It is available without using <code>require</code> in Rails.

blocks|key|1594914|text|Christopher+Bradford的答案是在任何地方使用HTML转义，因为现在大多数人都不使用CGI，您也可以使用Rack|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1594915|require+'rack/utils'
Rack::Utils.escape_html('Usage:+foo+"bar"+<baz>')|code-block|syntax|javascript|1594916|entityMap^0|1E|3|1O|4|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@$9|N|A|O|B|C]|$9|P|A|Q|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|R|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|S|8|@]|D|@]|E|$]]]|L|$]]

An addition to Christopher Bradford's answer to use the HTML escaping anywhere,
since most people don't use <code>CGI</code> nowadays, you can also use <code>Rack</code>:

<pre><code>require 'rack/utils'
Rack::Utils.escape_html('Usage: foo "bar" &lt;baz&gt;')
</code></pre>

blocks|key|1379501|text|您可以使用h()或html_escape()，但大多数人按照惯例使用h()。h()是html_escape()+in+rails的缩写。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1379502|在您的控制器中：|1379503|@stuff+=+"Hello+World!"|code-block|syntax|javascript|1379504|在您的视图中：|1379505|<%25=h+@stuff+%25>|1379506|如果您查看HTML源代码:您将看到没有实际加粗数据的输出。即它被编码为&lt;b&gt;Hello+World!&lt;/b&gt;。|1379507|它将显示为Hello+World!|1379508|entityMap^0|5|3|9|D|Y|3|12|3|16|D|0|0|0|0|0|Z|V|0|5|J|0^^$0|@$1|2|3|4|5|6|7|W|8|@$9|X|A|Y|B|C]|$9|Z|A|10|B|C]|$9|11|A|12|B|C]|$9|13|A|14|B|C]|$9|15|A|16|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|17|8|@]|D|@]|E|$]]|$1|H|3|I|5|J|7|18|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|19|8|@]|D|@]|E|$]]|$1|O|3|P|5|J|7|1A|8|@]|D|@]|E|$K|L]]|$1|Q|3|R|5|6|7|1B|8|@$9|1C|A|1D|B|C]]|D|@]|E|$]]|$1|S|3|T|5|6|7|1E|8|@$9|1F|A|1G|B|C]]|D|@]|E|$]]|$1|U|3|-4|5|6|7|1H|8|@]|D|@]|E|$]]]|V|$]]

You can use either <code>h()</code> or <code>html_escape()</code>, but most people use <code>h()</code> by convention. <code>h()</code> is short for <code>html_escape()</code> in rails.

In your controller:

<pre><code>@stuff = "&lt;b&gt;Hello World!&lt;/b&gt;"
</code></pre>

In your view:

<pre><code>&lt;%=h @stuff %&gt;
</code></pre>

If you view the HTML source: you will see the output without actually bolding the data. I.e. it is encoded as <code>&amp;lt;b&amp;gt;Hello World!&amp;lt;/b&amp;gt;</code>.

It will appear an be displayed as <code>&lt;b&gt;Hello World!&lt;/b&gt;</code>

blocks|key|1379891|text|不同方法的比较：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1379892|>+CGI::escapeHTML("quote+'+double+quotes+\"")
=>+"quote+&#39;+double+quotes+&quot;"

>+Rack::Utils.escape_html("quote+'+double+quotes+\"")
=>+"quote+&#x27;+double+quotes+&quot;"

>+ERB::Util.html_escape("quote+'+double+quotes+\"")
=>+"quote+&#39;+double+quotes+&quot;"|code-block|syntax|javascript|1379893|我自己写的是为了兼容Rails的ActiveMailer转义：|1379894|def+escape_html(str)
++CGI.escapeHTML(str).gsub("&#39;",+"'")
end|1379895|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

Comparaison of the different methods:

<pre><code>&gt; CGI::escapeHTML("quote ' double quotes \"")
=&gt; "quote &amp;#39; double quotes &amp;quot;"

&gt; Rack::Utils.escape_html("quote ' double quotes \"")
=&gt; "quote &amp;#x27; double quotes &amp;quot;"

&gt; ERB::Util.html_escape("quote ' double quotes \"")
=&gt; "quote &amp;#39; double quotes &amp;quot;"
</code></pre>

I wrote my own to be compatible with Rails ActiveMailer escaping:

<pre><code>def escape_html(str)
 CGI.escapeHTML(str).gsub("&amp;#39;", "'")
end
</code></pre>

blocks|key|1594849|text|h()对于转义引号也很有用。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1594850|例如，我有一个使用文本字段result[r].thtitle生成链接的视图。文本可以包含单引号。如果我没有在确认方法中转义result[r].thtitle，Javascript就会崩溃：|1594851|&lt;%25=+link_to_remote+"#{result[r].thtitle}",+:url=>{+:controller=>:resource,
:action+++++++++=>:delete_resourced,
:id+++++=>+result[r].id,
:th+++++=>+thread,++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:html+++++++=>{:title=>+"<=+Remove"},+++++++++++++++++++++++++++++++++++++++++++++++++++++++
:confirm++++=>+h("#{result[r].thtitle}+will+be+removed"),+++++++++++++++++++++++++++++++++++++++++++++++++++
:method+++++=>+:delete+%25>

&lt;a+href="#"+onclick="if+(confirm('docs:+add+column+&amp;apos;dummy&amp;apos;+will+be+removed'))+{+new+Ajax.Request('/resource/delete_resourced/837?owner=386&amp;th=511',+{asynchronous:true,+evalScripts:true,+method:'delete',+parameters:'authenticity_token='+%2B+encodeURIComponent('ou812')});+};+return+false;"+title="&lt;=+Remove">docs:+add+column+'dummy'</a>|code-block|syntax|javascript|1594852|注意：:html标题声明是由Rails神奇地转义的。|1594853|entityMap^0|0|3|0|D|H|1P|H|0|0|3|5|0^^$0|@$1|2|3|4|5|6|7|Q|8|@$9|R|A|S|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|T|8|@$9|U|A|V|B|C]|$9|W|A|X|B|C]]|D|@]|E|$]]|$1|H|3|I|5|J|7|Y|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|Z|8|@$9|10|A|11|B|C]]|D|@]|E|$]]|$1|O|3|-4|5|6|7|12|8|@]|D|@]|E|$]]]|P|$]]

<code>h()</code> is also useful for escaping quotes.

For example, I have a view that generates a link using a text field <code>result[r].thtitle</code>. The text could include single quotes. If I didn't escape <code>result[r].thtitle</code> in the confirm method, the Javascript would break:

<pre><code>&amp;lt;%= link_to_remote "#{result[r].thtitle}", :url=&gt;{ :controller=&gt;:resource,
:action =&gt;:delete_resourced,
:id =&gt; result[r].id,
:th =&gt; thread, 
:html =&gt;{:title=&gt; "&lt;= Remove"}, 
:confirm =&gt; h("#{result[r].thtitle} will be removed"), 
:method =&gt; :delete %&gt;

&amp;lt;a href="#" onclick="if (confirm('docs: add column &amp;amp;apos;dummy&amp;amp;apos; will be removed')) { new Ajax.Request('/resource/delete_resourced/837?owner=386&amp;amp;th=511', {asynchronous:true, evalScripts:true, method:'delete', parameters:'authenticity_token=' + encodeURIComponent('ou812')}); }; return false;" title="&amp;lt;= Remove"&gt;docs: add column 'dummy'&lt;/a&gt;
</code></pre>

Note: the <code>:html</code> title declaration is magically escaped by Rails.

I have an untrusted string that I want to show as text in an HTML page. I need to escape the chars '<code>&lt;</code>' and '<code>&amp;</code>' as HTML entities. The less fuss the better.

I'm using UTF8 and don't need other entities for accented letters.

Is there a built-in function in Ruby or Rails, or should I roll my own?

How to HTML encode/escape a string? Is there a built-in?

我有一个不受信任的字符串，我希望它在HTML页中显示为文本。我需要将字符'<‘和'&’转义为HTML实体。越少大惊小怪越好。我使用的是UTF8，重音字母不需要其他实体。Ruby或Rails中是否有内置函数，或者我是否应该使用自己的函数？

问如何对字符串进行HTML编码/转义？有没有内置的？
EN

回答 8

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何对字符串进行HTML编码/转义？有没有内置的？EN

回答 8

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何对字符串进行HTML编码/转义？有没有内置的？
EN