John Topley’s Weblog

Rails Tip #12: Easy HTML Input Validation

Not really a Rails-specific tip this one, more of a Ruby tip presented in a Rails’ context. Let’s imagine that your application accepts user input and you’re using HTML whitelisting to allow through a limited number of HTML elements, such as <a>, <strong>, <em> etc. This is fine, but you’ll also want to ensure that the user can’t enter badly-formed markup because that can seriously affect the rest of your page. Somehow you need to check that any markup entered is well-formed and inform the user if it isn’t.

It turns out this is easy to do using Ruby’s REXML module, which performs XML processing. For example, to validate a field named lyrics in a Track ActiveRecord model, you could add the following to the Track model class:

protected
def validate
  begin
    REXML::Document.new("<lyrics>#{self.lyrics}</lyrics>")
  rescue REXML::ParseException => exception
    errors.add(:lyrics, 'are not valid HTML.')
  end
end

—Note that the <lyrics> element in the REXML::Document constructor can be anything you like because it’s just there to provide a bit of an XML structure around the user’s input. Sending the message message to the rescued exception object will return more detailed information about why the parsing failed if you require that.

Paul Thurrott’s Hallucinating Again

I just don’t understand Paul Thurrott. Although I now prefer Apple’s products, I occasionally visit his site because I’m still vaguely interested in the latest news from Microsoft. Much of what Paul writes is balanced and fair, but sometimes he comes out with some complete tosh! The latest being this gem from his preview of Apple’s new MobileMe service:

“I’m not interested in covering every single product that comes out of Redmond, and I am not a Microsoft fan-boy. What I’m interested is products and technologies that affect you, the Windows user. You’ve made a decision to use the world’s best operating system as the center of your computing experience, and I endorse and support that decision.”

—Does anybody seriously think that Windows is the world’s best operating system? It’s the world’s most commercially successful OS, certainly. It has the most number of applications available for it, granted. But the best? Get real, Paul! Mac OS X Leopard wipes the floor with Windows Vista or Windows XP, as more and more people are discovering. Sure, it doesn’t have the shear glut of software that Windows has, but the software is does have covers all the bases and is of a uniformly high quality.

I can only think of one version of Windows that might have been a contender for the title of the world’s best operating system and that was Windows 2000. It was mature and stable and its Windows NT architecture was far in advance of the tired old classic MacOS that was Apple’s offering at the time. I really liked it, even though it had a tendency of switching the focus away from the active window which sometimes drove me nuts.

Sadly Windows 2000 was so late that it barely had time to take off before its successor was announced. Windows XP was too rough around the edges for my liking. Although there was much to like, it did feel unfinished to me; it felt like it was rushed out of the door. Now here we are seven years later and Windows Vista is much the same. That’s quite an achievement considering that over five years elapsed between the two versions.

Going back to Windows after using Leopard is like a Windows 2000 user stepping back in time to Windows 95 or even Windows 3.1. It just doesn’t work as well and feels less polished. Perhaps Windows 7 will be a contender for the title of the world’s best operating system, but I doubt it somehow given Microsoft’s recent track record. Windows is crippled by the burden of its own past, whereas Apple are free to keep moving forward. Sorry Paul.



Sign In