I currently use:
validates_format_of :url, :with => /^[-\w\_.]+$/i
to only allow alphanumerics, dashes, underscores, and dots to prevent
cross site scripting when I later reconstruct these urls, but I can't
figure out how to allow "/" as well.
Any ideas?
--
You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group.
To post to this group, send email to rubyonra...@googlegroups.com.
To unsubscribe from this group, send email to rubyonrails-ta...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/rubyonrails-talk?hl=en.
am a newbee.. but i think u can use underscore method for the whole
url that will put '/' instead of ' : '
On Dec 18, 11:01 pm, AlwaysCharging <goodg...@gmail.com> wrote:
/^http:\/\/myhostname\.com\/foo$/i
would become
%r{http://myhostname\.com/foo}i
But before you start piecing your own regexp together have a look at
the regexp patterns in the URI::REGEXP::PATTERN module (in your ruby lib
directory under uri/common.rb). Could save you some work depending on
what and how you want to validate.
Sven
And of course I forgot the anchors in the second example. So the correct
version is:
%r{^http://myhostname\.com/foo$}i
%r{pattern}
To continue your example below:
validates_format_of :url, :with => %r{^[-\w_./]+$}
And, Thank you to everyone else that weighed in as well, definitely
some other options to look into.
Side note: Anybody know why the period doesn't have to be escaped?
Like just "." allows the dot to be input, as well as "\."
So, [-\w\_\.\/] works just as [-\w\_.\/]. Why is this?