允许用户只输入特定标签

Question

I'm making an app where I need users to input description using a wysiwyg editor. I cannot trust user input, so I need to only allow a , em , ul , li tags. How do I strip the others easily?

Answer 1

https://github.com/rgrove/sanitize/

Answer 2

Rails has some sanitizing methods baked in. http://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html

These are view helpers, so if you want to sanitize before saving the user input you'll need to include the helpers somewhere useful.