title: Ruby on Rails and XSS prevention
body: <p>What are the practices to prevent XSS in Ruby on Rails? 
  I found many old docs on the web and most of the time it was all about using
  <strong>h/html_escape</strong> helper to escape any variable that comes from users. </p>
  
  <p>I understood from newer docs that in the version 2.0 and above there is
  <strong>sanitize</strong> method that is automatically cleaning the input from supposedly
  malicious input. Is it enough or are you doing something more to secure your
  applications?</p>