title: Sanitizing URL to prevent XSS in Rails
body: <p>In an rails application, users can create events and post an url to link to the external event site.</p>
  
  <p>How do I sanitize the urls to prevent XSS links?</p>
  
  <p>Thanks in advance,</p>
  
  <p>example of XSS, which is not preventable by rails' sanitize method</p>
  
  <pre><code>@url = "javascript:alert('XSS')"
  &lt;a href="&lt;%=sanitize @url%&gt;"&gt;test link&lt;/a&gt;
  </code></pre>