Protecting against Cross-Site Scripting in Ruby

Cross-Site Scripting (often abbreviated XSS, to avoid confusion with CSS) is another type of attack on web application security—and yet another example of the principle don't trust user input. In the case of SQL injection, problems surfaced when unescaped user data was included in SQL queries. In the case of XSS, vulnerabilities emerge when unescaped user data is included in HTML output.
Back to article