Rails String Interpolation in a string from a database

Question

So here is my problem.

I want to retrieve a string stored in a model and at runtime change a part of it using a variable from the rails application. Here is an example:

I have a Message model, which I use to store several unique messages. So different users have the same message, but I want to be able to show their name in the middle of the message, e.g.,

"Hi #{user.name}, ...."

I tried to store exactly that in the database but it gets escaped before showing in the view or gets interpolated when storing in the database, via the rails console.

Thanks in advance.

Sebastian vom Meer · Accepted Answer · 2014-04-29 09:23:07Z

70

I don't see a reason to define custom string helper functions. Ruby offers very nice formatting approaches, e.g.:

"Hello %s" % ['world']

or

"Hello %{subject}" % { subject: 'world' }

Both examples return "Hello world".

answered Apr 29, 2014 at 9:23

Sebastian vom Meer

5,2442 gold badges31 silver badges37 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

januszm Over a year ago

This is imho the most elegant and simple solution to the problem

CDub Over a year ago

I agree. This is the simplest solution using existing functionality.

stephan.com Over a year ago

very nice, I'm going with this.

zhisme Over a year ago

is it SQL safe interpolation, didn't find anything about it?

schmijos Over a year ago

The user can break this code easily by providing not existing keys in the template.

|

mu is too short · Accepted Answer · 2018-07-12 02:38:46Z

23

If you want

"Hi #{user.name}, ...."

in your database, use single quotes or escape the # with a backslash to keep Ruby from interpolating the #{} stuff right away:

s = 'Hi #{user.name}, ....'
s = "Hi \#{user.name}, ...."

Then, later when you want to do the interpolation you could, if you were daring or trusted yourself, use eval:

s   = pull_the_string_from_the_database
msg = eval '"' + s + '"'

Note that you'll have to turn s into a double quoted string in order for the eval to work. This will work but it isn't the nicest approach and leaves you open to all sorts of strange and confusing errors; it should be okay as long as you (or other trusted people) are writing the strings.

I think you'd be better off with a simple micro-templating system, even something as simple as this:

def fill_in(template, data)
  template.gsub(/\{\{(\w+)\}\}/) { data[$1.to_sym] }
end
#...
fill_in('Hi {{user_name}}, ....', :user_name => 'Pancakes')

You could use whatever delimiters you wanted of course, I went with {{...}} because I've been using Mustache.js and Handlebars.js lately. This naive implementation has issues (no in-template formatting options, no delimiter escaping, ...) but it might be enough. If your templates get more complicated then maybe String#% or ERB might work better.

edited Jul 12, 2018 at 2:38

answered Jul 21, 2011 at 17:19

mu is too short

436k71 gold badges863 silver badges822 bronze badges

2 Comments

Raphael Melo Over a year ago

Thanks, that worked... I was already storing the single quoted string. I was just missing how to interpolate after getting it from the database. I am aware of the security risk around using this, but the users can't change this string directly.

dennismonsewicz Over a year ago

I will add that if your string contains HTML use the raw (apidock.com/rails/ActionView/Helpers/OutputSafetyHelper/raw) method vs the html_safe method.

schmijos · Accepted Answer · 2021-12-08 21:23:45Z

0

gsub is very powerful in Ruby.

It takes a hash as a second argument so you can supply it with a whitelist of keys to replace like that:

template = <<~STR
Hello %{user_email}!

You have %{user_voices_count} votes!

Greetings from the system
STR

template.gsub(/%{.*?}/, {
  "%{user_email}" => '[email protected]',
  "%{user_voices_count}" => 5,
  "%{release_distributable_total}" => 131,
  "%{entitlement_value}" => 2,
})

Compared to ERB it's secure. And it doesn't complain about single % and unused or inexistent keys like string interpolation with %(sprintf) does.

edited Dec 8, 2021 at 21:23

answered Dec 8, 2021 at 21:07

schmijos

8,8434 gold badges54 silver badges60 bronze badges

1 Comment

wbr Over a year ago

I like this one. Simple, elegant, and flexible. It suited my project perfectly.

Spacepotato · Accepted Answer · 2015-07-23 06:34:37Z

-1

Adding another possible solution using Procs:

#String can be stored in the database
string = "->(user){ 'Hello ' + user.name}"

proc = eval(string)

proc.call(User.find(1)) #=> "Hello Bob"

answered Jul 23, 2015 at 6:34

Spacepotato

14410 bronze badges

1 Comment

ricks Over a year ago

Be very careful using eval(); you're giving that code full access to your system.

Collectives™ on Stack Overflow

Rails String Interpolation in a string from a database

4 Answers 4

6 Comments

2 Comments

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

6 Comments

2 Comments

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related