ruby on rails - Safe Erb plugin Implementation Issue -

i trying implement safe erb plugin in rails 2.0.2 app. using version project specific purposes along ruby 1.8.7.

i have referred following tutorials:

http://www.railslodge.com/plugins/430-safe-erb http://agilewebdevelopment.com/plugins/safe_erb

i make sense of above url's newbie rails , rails related plugins. found above tutorials generic.

i couldn't relate plugin's use great extent in terms of real world sense above tutorials. please enlighten me on usage on day day real world....?

i have implemented books appl has author, title , publishing date. facing issues implementing taint feature of plugin

in second tutorial, need call tainted? method objects class. have done in create method of books_controller.rb. code create method looks this:

 def create     @book = book.new(params[:book])    @book.publishing_date = params[:publishing_date]      respond_to |format|        if @book.save         flash[:notice] = 'book created.'         format.html { redirect_to(@book) }         format.xml  { render :xml => @book, :status => :created,  :location => @book }       else         format.html { render :action => "new" }         format.xml  { render :xml => @book.errors, :status =>  :unprocessable_entity }       end        if @book.tainted?         flash[:notice] = 'books tainted'         format.html { redirect_to(@book) }         format.xml  { render :xml => @book, :status => :created,  :location => @book }       else         flash[:notice] = 'books aren\'t tainted'         format.html { render :action => "new" }         format.xml  { render :xml => @book.errors, :status =>  :unprocessable_entity }       end      end 

upon creating new book record notice saying "books aren't tainted". have copied plugin vendor/plugins directory.

as per second tutorial url "the string becomes tainted when read io, such data read db or http request."

but not happening in case when try create new book record. need explicitly taint string input taking(its in varchar per db types - guess shouldn't issue). if yes please tell me how it.

or

if not above case.. missing something?

any insights on appreciated.

thank you..

to begin with, if can move on rails 3 , ruby 1.9.2, please so. worth effort. rails 2.0.2 released in 2007 , @ least 3 years old. rails 3 provides better protection plugin, right out of box.

having said that, safe-erb appears providing xss protection. going through version of plugin @ https://github.com/abedra/safe-erb, won't need special anywhere in app work. install plugin in vendor/plugins , go. controller should without plugin. can away if tainted block.

the way plugin works hooking various parts of rails processing queue , doing taint management make views automatically throw error whenever there unescaped user text. use it, don't need in models , controllers. in views, make sure data passed through h before being displayed.