title: How good is the Rails sanitize() method?
body: <p>Can I use <a href="http://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#M002163" rel="noreferrer">ActionView::Helpers::SanitizeHelper#sanitize</a> on user-entered text that I plan on showing to other users? E.g., will it properly handle <a href="http://ha.ckers.org/xss.html" rel="noreferrer">all cases described on this site</a>?</p>
  
  <p>Also, the documentation mentions:</p>
  
  <blockquote>
    <p>Please note that sanitizing
    user-provided text does not guarantee
    that the resulting markup is valid
    (conforming to a document type) or
    even well-formed. The output may still
    contain e.g. unescaped ’&lt;’, ’>’, ’&amp;’
    characters and confuse browsers.</p>
  </blockquote>
  
  <p>What's the best way to handle this? Pass the sanitized text through <code>Hpricot</code> before displaying?</p>