diff options
| author | Neil Matatall <oreoshake@github.com> | 2017-09-27 07:14:37 -1000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-09-27 07:14:37 -1000 |
| commit | 521266f913083c3029567ffe647e08e39af7f18a (patch) | |
| tree | b10d5bffba37707efcca6caeed2b636ec10ea5b1 /guides/source | |
| parent | 9c833ba3a39923a49d1e52ed1eb2289d7944e780 (diff) | |
| download | rails-521266f913083c3029567ffe647e08e39af7f18a.tar.gz rails-521266f913083c3029567ffe647e08e39af7f18a.tar.bz2 rails-521266f913083c3029567ffe647e08e39af7f18a.zip | |
Encourage html-safe API in layouts/rendering guide
While the code example was not unsafe, it
encourages the use of confusingly unsafe APIs
(specifically `html_safe`). We have a safe
alternative and we should encourage people to use
it under all circumstances.
Diffstat (limited to 'guides/source')
| -rw-r--r-- | guides/source/layouts_and_rendering.md | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/guides/source/layouts_and_rendering.md b/guides/source/layouts_and_rendering.md index fe2477f2ae..b9b327252f 100644 --- a/guides/source/layouts_and_rendering.md +++ b/guides/source/layouts_and_rendering.md @@ -232,14 +232,14 @@ You can send an HTML string back to the browser by using the `:html` option to `render`: ```ruby -render html: "<strong>Not Found</strong>".html_safe +render html: helpers.tag.strong('Not Found') ``` TIP: This is useful when you're rendering a small snippet of HTML code. However, you might want to consider moving it to a template file if the markup is complex. -NOTE: When using `html:` option, HTML entities will be escaped if the string is not marked as HTML safe by using `html_safe` method. +NOTE: When using `html:` option, HTML entities will be escaped if the string is not composed with `html_safe`-aware APIs. #### Rendering JSON |