title: do we need to explicitly sanitize strong params in rails?
body: <pre><code>class ApplicationController &lt; ActionController::Base
  ....
  
    def sanitize(value)
       ActionController::Base.helpers.sanitize(value.try(:strip)).gsub('&amp;amp;', '&amp;').gsub('&amp;gt;', '&gt;').gsub('&amp;lt;', '&lt;') if value.present?
    end
  
  end
  </code></pre>
  
  <p>and in a resource</p>
  
  <pre><code>class UsersController &lt; ApplicationController
  ...
   def update
    if current_user.update(update_users_params)
      redirect_to root_path
    end
  end
  
  private
  
  
   def update_users_params
      params.require(:user).permit(username: sanitize(params[:user] [:username]),
                    location: sanitize(params[:user][:location]))
   end
  </code></pre>
  
  <p>here location and username are User model attributes.</p>
  
  <p>Actual behaviour without using sanitize method:</p>
  
  <p>if we add <code>"Hey &lt;script type='text/javascript'&gt; alert('Hi') &lt;/script&gt;"</code> to username or location input field of a user form ,after form submission it is stored as it is</p>
  
  <pre><code> "Hey &lt;script type='text/javascript'&gt; alert('Hi') &lt;/script&gt;"
  </code></pre>
  
  <p>do we need to sanitize these attributes for script tags before storing into database?
  and </p>
  
  <p>does strong params will not sanitize script tags from those attributes?</p>