ERB Basics
Fast recall
Quick revision
Core answer
.html.erb view, <% ... %> runs Ruby without inserting its result, <%= ... %> evaluates an expression and adds its result to the response, and <%# ... %> is an ERB comment. Rails escapes unsafe string output by default, so bypassing that protection with raw or html_safe is safe only for content the application has already sanitised or fully controls.Whether you know <% %> (run, no output) vs <%= %> (run and output), and that <%= %> escapes HTML by default.
Using <% %> where you need output (nothing shows), or raw on untrusted content (XSS risk).
ERB is HTML with Ruby: <% %> runs (no output), <%= %> runs + outputs (escapes HTML by default). Loop with each, output with <%=. Keep views dumb.
Interview-ready guide
Interview answer
ERB means Embedded Ruby. A Rails .html.erb file mixes ordinary HTML with small Ruby expressions while the server builds a response. Rails compiles the template and sends only the resulting HTML to the browser; the browser never receives the Ruby source.
Use <% ... %> for control flow or setup whose result should not be printed, <%= ... %> for a value that belongs in the response, and <%# ... %> for a template comment. Opening an if or each with a control tag and printing only the needed values keeps the output intentional.
A list view can open a loop with <% products.each do |product| %> and place <%= product.name %> inside each list item. The control tag decides how many fragments are built; the output tag supplies the visible value. Calling puts inside the template does not insert that value into the HTML response.
Rails HTML-escapes ordinary unsafe strings placed through an output tag, so a product name containing markup is shown as text. raw and .html_safe bypass that protection and must not be applied casually to user input. ERB should describe presentation and call view helpers; data loading and business rules belong outside the template.
ERB Basics
Direct Answer
ERB, or Embedded Ruby, is a template format that combines ordinary text such as HTML with Ruby expressions. In a Rails .html.erb view, <% ... %> runs Ruby without inserting its result, <%= ... %> evaluates an expression and adds its result to the response, and <%# ... %> is an ERB comment. Rails escapes unsafe string output by default, so bypassing that protection with raw or html_safe is safe only for content the application has already sanitised or fully controls.
Deep Dive & Architecture
A template is not sent to the browser as Ruby source. Rails compiles the ERB into a method that appends static text and evaluated output to a buffer. By the time the client receives the response, only the resulting HTML remains.
Control-flow tags shape which static and dynamic fragments reach that buffer. They can open a Ruby block in one tag and close it later because the generated method contains one continuous Ruby program. Output tags append a value after converting it for the response context.
HTML safety is contextual. Escaping converts characters such as < into text-safe entities so a value is displayed rather than treated as a tag or script. Sanitising is a separate operation that allows only an intended subset of markup. Marking an unsafe value as safe skips the guard without cleaning it.
A view can call helpers for links, formatting, tags, and localisation. Queries or multi-step domain decisions inside the template are harder to reuse and can create hidden performance problems, especially when a loop triggers database access for every row.
Code Example
<!-- app/views/products/index.html.erb -->
<h1>Products</h1>
<% if @products.empty? %>
<p>No products yet.</p>
<% else %>
<ul>
<% @products.each do |product| %>
<li><%= product.name %></li>
<% end %>
</ul>
<% end %>
<%# This comment is absent from the HTML response. %>
Common Mistakes & Pitfalls
Using <% %> where you need output (nothing shows), or raw on untrusted content (XSS risk).
Check your understanding
Answer these without looking back at the article.
- What is the difference between `<% %>` and `<%= %>`?
- Why does `puts` not render a value into an ERB page?
- What is the difference between escaping, sanitising, and `html_safe`?
Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.