diff options
| author | yui-knk <spiketeika@gmail.com> | 2015-07-24 23:07:16 +0900 |
|---|---|---|
| committer | yui-knk <spiketeika@gmail.com> | 2015-07-24 23:07:16 +0900 |
| commit | f9015ada7e414a1a296499d5c92463016ba200ef (patch) | |
| tree | 7083fed74194109e112b81f75a8ee15fb598c985 | |
| parent | 1b6131d38586e907461f53e65faab83adeb2306d (diff) | |
| download | rails-f9015ada7e414a1a296499d5c92463016ba200ef.tar.gz rails-f9015ada7e414a1a296499d5c92463016ba200ef.tar.bz2 rails-f9015ada7e414a1a296499d5c92463016ba200ef.zip | |
[ci skip] Fix minor typo
* Remove `,`
* Fix `<`; -> `<`
| -rw-r--r-- | guides/source/security.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/guides/source/security.md b/guides/source/security.md index 58f79901f1..adbab2a154 100644 --- a/guides/source/security.md +++ b/guides/source/security.md @@ -754,7 +754,7 @@ s = sanitize(user_input, tags: tags, attributes: %w(href title)) This allows only the given tags and does a good job, even against all kinds of tricks and malformed tags. -As a second step, _it is good practice to escape all output of the application_, especially when re-displaying user input, which hasn't been input-filtered (as in the search form example earlier on). _Use `escapeHTML()` (or its alias `h()`) method_ to replace the HTML input characters &, ", <, > by their uninterpreted representations in HTML (`&`, `"`, `<`;, and `>`). However, it can easily happen that the programmer forgets to use it, so _it is recommended to use the SafeErb gem. SafeErb reminds you to escape strings from external sources. +As a second step, _it is good practice to escape all output of the application_, especially when re-displaying user input, which hasn't been input-filtered (as in the search form example earlier on). _Use `escapeHTML()` (or its alias `h()`) method_ to replace the HTML input characters &, ", <, > by their uninterpreted representations in HTML (`&`, `"`, `<` and `>`). However, it can easily happen that the programmer forgets to use it, so _it is recommended to use the SafeErb gem. SafeErb reminds you to escape strings from external sources. ##### Obfuscation and Encoding Injection |