Escaping HTML in Rails

Question

What is the recommended way to escape HTML to prevent XSS vulnerabilities in Rails apps?

Should you allow the user to put any text into the database but escape it when d

Answer 1

Use the h method in your view template. Say you have a post object with a comment property:

    <%= h post.comment %>