Question

这是我控制器中的操作代码。

def index
  if params[:writer]
    if Article.published.where('writer = ?', params[:writer]).count < 1
      redirect_to articles_url, :notice => "There are no articles by #{params[:writer]}"
    else
      @articles = Article.published.where('writer = ?', params[:writer]).order('published_at DESC').page(params[:page]).per(20)
    end
  else
    @articles = Article.published.order('published_at DESC').page(params[:page]).per(20)
  end
end

我认为问题相当明显。在一些简单的测试中，Rails似乎逃脱了:notice就好了，但我想确保我没有通过这样做来惹麻烦。

Answer 1

那应该没问题。当您通过＆lt;％=％＆gt;

显示时，Rails 3在默认情况下会转义为HTML

如果你需要它未转义，你会将其显示为

<%= flash.html_safe %>

将params置于闪存通知中是否安全？

1 个答案: