document.write('<link rel="stylesheet" href="http://flowcoder.com/stylesheets/pygment_trac.css" />');
document.write('<link rel="stylesheet" href="http://flowcoder.com/stylesheets/embed.css" />');
document.write('<div class="flowcoder_post flowcoder_clearfix">');
document.write('<div class="flowcoder_posttitle"><a href=\"http://flowcoder.com/177\">Automatic html escaping with Sinatra and Erubis<\/a></div>');
document.write('<div class="flowcoder_postbody flowcoder_syntax"><div class=\"highlight\"><pre><span class=\"c1\"># Requires Sinatra &gt;= 1.0 and Tilt &gt;= 0.9<\/span>\n<span class=\"c1\"># (fyi Tilt 0.8 is bundled with Sinatra 1.0, so you&#39;ll need to upgrade <\/span>\n<span class=\"c1\"># to the latest gem version)<\/span>\n<span class=\"c1\">#<\/span>\n<span class=\"c1\"># Tilt 0.9 adds an :escape_html option for Erubis, which allows you<\/span>\n<span class=\"c1\"># to leverage Erubis&#39; auto-escape functionality, so that anything inside <\/span>\n<span class=\"c1\"># &lt;%= %&gt; blocks will be html-escaped by default. <\/span>\n<span class=\"c1\">#<\/span>\n<span class=\"c1\"># To skip escaping, use a &lt;%== %&gt; block.<\/span>\n<span class=\"nb\">require<\/span> <span class=\"s1\">&#39;rubygems&#39;<\/span>\n<span class=\"n\">gem<\/span> <span class=\"s2\">&quot;sinatra&quot;<\/span><span class=\"p\">,<\/span> <span class=\"s2\">&quot;&gt;= 1.0&quot;<\/span>\n<span class=\"n\">gem<\/span> <span class=\"s2\">&quot;tilt&quot;<\/span><span class=\"p\">,<\/span> <span class=\"s2\">&quot;&gt;= 0.9&quot;<\/span>\n<span class=\"nb\">require<\/span> <span class=\"s1\">&#39;sinatra&#39;<\/span>\n<span class=\"nb\">require<\/span> <span class=\"s1\">&#39;erubis&#39;<\/span>\n\n<span class=\"c1\"># Globally set erubis to render with auto-escaping of html<\/span>\n<span class=\"n\">set<\/span> <span class=\"ss\">:erubis<\/span><span class=\"p\">,<\/span> <span class=\"ss\">:escape_html<\/span> <span class=\"o\">=&gt;<\/span> <span class=\"kp\">true<\/span>\n\n<span class=\"n\">get<\/span> <span class=\"s1\">&#39;/&#39;<\/span> <span class=\"k\">do<\/span>\n  <span class=\"n\">erubis<\/span> <span class=\"ss\">:index<\/span>\n<span class=\"k\">end<\/span>\n\n<span class=\"n\">helpers<\/span> <span class=\"k\">do<\/span>\n  <span class=\"c1\"># Convenience method for manually escaping html<\/span>\n  <span class=\"k\">def<\/span> <span class=\"nf\">h<\/span><span class=\"p\">(<\/span><span class=\"n\">text<\/span><span class=\"p\">)<\/span>\n    <span class=\"no\">Rack<\/span><span class=\"o\">::<\/span><span class=\"no\">Utils<\/span><span class=\"o\">.<\/span><span class=\"n\">escape_html<\/span><span class=\"p\">(<\/span><span class=\"n\">text<\/span><span class=\"p\">)<\/span>\n  <span class=\"k\">end<\/span>\n  \n  <span class=\"k\">def<\/span> <span class=\"nf\">link_to<\/span><span class=\"p\">(<\/span><span class=\"n\">text<\/span><span class=\"p\">,<\/span> <span class=\"n\">href<\/span><span class=\"p\">)<\/span>\n    <span class=\"sx\">%(&lt;a href=&quot;<\/span><span class=\"si\">#{<\/span><span class=\"n\">href<\/span><span class=\"si\">}<\/span><span class=\"sx\">&quot;&gt;<\/span><span class=\"si\">#{<\/span><span class=\"n\">h<\/span><span class=\"p\">(<\/span><span class=\"n\">text<\/span><span class=\"p\">)<\/span><span class=\"si\">}<\/span><span class=\"sx\">&lt;/a&gt;)<\/span>\n  <span class=\"k\">end<\/span>\n<span class=\"k\">end<\/span>\n\n<span class=\"cp\">__END__<\/span>\n\n<span class=\"cp\">@@ index<\/span>\n<span class=\"cp\">&lt;p&gt;&lt;%= &quot;This string &lt;b&gt;will&lt;/b&gt; be html escaped.&quot;%&gt;&lt;/p&gt;<\/span>\n<span class=\"cp\">&lt;p&gt;&lt;%== &quot;This string &lt;b&gt;will not&lt;/b&gt; be html escaped.&quot;%&gt;&lt;/p&gt;<\/span>\n<span class=\"cp\">&lt;p&gt;&lt;%== link_to &quot;This link tag inner text &lt;b&gt;will&lt;/b&gt; be escaped manually in our link_to helper, but the surrounding tag will not&quot;, &quot;#&quot; %&gt;&lt;/p&gt;<\/span>\n\n<span class=\"cp\">@@ layout<\/span>\n<span class=\"cp\">&lt;!DOCTYPE HTML&gt;<\/span>\n<span class=\"cp\">&lt;head&gt;&lt;title&gt;Erubis escaping test&lt;/title&gt;&lt;/head&gt;<\/span>\n<span class=\"cp\">&lt;body&gt;&lt;%== yield %&gt;&lt;/body&gt;<\/span>\n<\/pre><\/div>\n</div>');
document.write('<div class="flowcoder_bottombar flowcoder_clearfix">');
document.write('<div class="flowcoder_postedby">Posted by <a href=\"http://flowcoder.com/gbuesing\">gbuesing<\/a> on <a href=\"http://flowcoder.com/\">Flowcoder<\/a></div>');
document.write('<div class="flowcoder_viewraw"><a href=\"http://flowcoder.com/177.txt\">view raw<\/a></div>');
document.write('</div></div>');
