rgrove/sanitize — Issue #48: How to whitelist &
Author: bhellman1
Created: 2011-11-08 19:19:20+00:00
State: open

If you submit a field with "hello & world" sanitize is saving that in the DB as:

hello & world

How can you whitelist the & . We want sanitize to remove all possible malicious html and JS/script tags. but we're ok allowing the ampersand.

I tried but that had no effect:

Sanitize.clean(self[column.name], :elements => %w[
& a abbr b blockquote br cite code dd dfn dl dt em i kbd li mark ol p pre
q s samp small strike strong sub sup time u ul var
]

)

Thanks