"in an ECR template, simply using <%= user.comment %> will convert potentially malicious characters like < and > into their HTML entities (< and >)."
I love how there are endless websites producing authoritative-sounding misinformation like this
https://compile7.org/escaping/how-to-use-html-escaping-in-crystal/#basic-escaping-with-htmlescape
Will Richardson
npub137…rf0xv
2026-08-17 11:09:01 UTC
Author Public Key
npub137ddq8nm77tmwhc6gkhugwfvn7f74fdrmn6tgd3nel777z5mr7qqsrf0xvSeen on
wss://relay.ditto.pubPublished at
2026-08-17 11:09:01 UTCEvent JSON
{
"id": "148635304df861d0a21ed902375979b2855d5bfc46345dec9577a5573e1ed7f0",
"pubkey": "8f9ad01e7bf797b75f1a45afc4392c9f93eaa5a3dcf4b43633cffdef0a9b1f80",
"created_at": 1786964941,
"kind": 1,
"tags": [
[
"proxy",
"https://ruby.social/users/willhbr/statuses/117110534398553350",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "\"in an ECR template, simply using \u003c%= user.comment %\u003e will convert potentially malicious characters like \u003c and \u003e into their HTML entities (\u0026lt; and \u0026gt;).\"\n\nI love how there are endless websites producing authoritative-sounding misinformation like this\n\nhttps://compile7.org/escaping/how-to-use-html-escaping-in-crystal/#basic-escaping-with-htmlescape",
"sig": "44041b6e7b534506cc87bb8f15c40542b050c5776fbd5913180410a82c2f86be822d87aa8c0ff5c91815efe5838b94d9b8301f8085aefbc835a82c0f2553b74e"
}