From: Mike Dalessio <mike.dalessio@...>
Date: 2009-10-23T08:26:07+09:00
Subject: Re: sanitizing html tags (content)

--0016e68789e656b44604768e6bb7
Content-Type: text/plain; charset=ISO-8859-1

On Thu, Oct 22, 2009 at 5:15 PM, Tim Pease <tim.pease@gmail.com> wrote:

> On Oct 22, 2009, at 12:03 PM, Aljaz Fajmut wrote:
>
>  Hello,
>>
>> I have a variable which holds the following html code:
>>
>> <object width="425" height="344"><param name="movie"
>> value="http://www.youtube.com/v/6fEogbKnNcQ&hl=en&fs=1&"></param><param
>> name="allowFullScreen" value="true"></param><param
>> name="allowscriptaccess" value="always"></param><embed
>> src="http://www.youtube.com/v/6fEogbKnNcQ&hl=en&fs=1&"
>> type="application/x-shockwave-flash" allowscriptaccess="always"
>> allowfullscreen="true" width="425" height="344"></embed></object>
>> <span>some text<a href="..">link</a> .. </span>
>>
>>
>> Now I'd like to process it so that everything would be stripped except
>> object/param/embed tags (span tag and its content should be removed).
>>
>> What is the best way to compliment that?
>>
>> I've installed sanitize gem but it wont allow me to strip/remove content
>> inside html tags as well.
>>
>> I though of regex but I'm unsure about this.
>>
>
Please don't use regexes. Think of the children!

Instead, try Loofah, which is based on Nokogiri and has some nice
sanitization helpers:

http://loofah.rubyforge.org/

Good luck!

--0016e68789e656b44604768e6bb7--