Further Information in C#.NET

Make Quick Response Code in C#.NET Further Information

Standard library documentation for English: http://www.ruby-doc.org/stdlib/libdoc/ English/rdoc/index.html

ERB is a templating library for Ruby that allows you to mix content and Ruby code. ERB is used as the main template system in Ruby on Rails when rendering RHTML views (see 13 for more information). Mixing Ruby code with other content results in a powerful templating system that s a little reminiscent of PHP.

The ERB library is a part of the standard library, so it comes with Ruby by default. To use it, you only need to place this line near the start of your program: require 'erb'

ERB works by accepting data written in ERB s template language, converting it to Ruby code that can produce the desired output, and then executing that code.

A basic ERB script might look like this: <% 1.upto(5) do |i| %> <p>This is iteration <%= i %></p> <% end %> In this template, Ruby and HTML code are mixed. Ruby code that s meant to be executed is placed within <% and %> tags. Ruby code that s to be evaluated and printed is placed within <%= and %> tags, and normal content is left as is. Running the preceding template through ERB would result in this output: <p>This <p>This <p>This <p>This <p>This is is is is is iteration iteration iteration iteration iteration 1</p> 2</p> 3</p> 4</p> 5</p>

whitespace isn t an issue with HTML or XHTML, but if you re using ERB to output other forms of data, you might need to develop your templates with whitespace in mind.

You use the ERB library to render ERB code from Ruby: require 'erb' template = <<EOF <% 1.upto(5) do |i| %> <p>This is iteration <%= i %></p> <% end %> EOF puts ERB.new(template).result The result method doesn t print the data directly, but returns the rendered template to the caller, so you then print it to the screen with puts. If you d rather have ERB print the output directly to the screen, you can use the run method: ERB.new(template).run

ERB templates can also access variables in the current scope. For example: require 'erb' array_of_stuff = %w{this is a test} template = <<EOF <% array_of_stuff.each_with_index do |item, index| %> <p>Item <%= index %>: <%= item %></p> <% end %> EOF puts ERB.new(template).result(binding)

n Note The result and run methods accept a binding as an optional parameter if you want ERB to have

access to variables that are defined in a different (or the current) scope, or if you want to sandbox the variables to which templates have access. If you allow them access to your main binding, as in the preceding example, remember that code within templates could change the value of the current variables!

Due to ERB allowing Ruby code to be executed among other content, it s not wise to allow users you cannot trust to be able to create or edit ERB templates on systems under your control. That s because they could execute arbitrary code that could access the file system, delete data, or otherwise damage your system (remember that Ruby can use backticks to run any program on the system accessible to the current user). In 11, you looked at the concept of safe levels provided by Ruby, which allow you to restrain the capabilities of code, particularly in relation to running arbitrary programs or using tainted data with dangerous commands such as eval. ERB.new accepts a safe level as an optional second parameter, which goes a long way toward making your template rendering a safer process: require 'erb' template = <<EOF Let's try to do something crazy like access the filesystem.. <%= `ls` %> EOF puts ERB.new(template, 4).result # Using safe level 4!

/usr/local/lib/ruby/1.8/erb.rb:739:in `eval': Insecure: can't modify trusted binding (SecurityError) The safe level applies only to the code executed to run the code for the ERB template, whereas when you ve previously used safe levels, you ve been unable to lower them. The way this works is that when a safe mode is used with ERB, ERB creates a new thread for the processing of the ERB code, which allows a separate safe level to be set from that of the main code. Refer to 11 or Appendix B for a refresher on what capabilities each safe level provides.