What does <% = h ...%> mean in Rails?

Question

I found the following syntax here :

 <%=h @person.first_name %> 

What does h mean?

Answer 1

This is for escaping tag output to avoid cross-site scripting. In rails 3, it was changed to the default value for a string (so instead of talking about that string, you say it's a safe string).

http://api.rubyonrails.org/classes/ERB/Util.html#method-ch

Answer 2

h is an alias of the html_escape method in Rails.

If you do not avoid the text with h, then someone can write javascript there and it will be executed when you display the page.

So, if you are not sure that the data that you show is absolutely safe, run it through a filter that eludes characters from HTML tags.