title: Rails - javascript injections
body: <p>I'm using Rails 3 and Ruby 1.9.2. I'm doing anything special when I'm displaying the content of my post, I'm just doing</p>
  
  <pre><code>&lt;%=@post.content%&gt;
  </code></pre>
  
  <p>When I add</p>
  
  <pre><code>"&lt;script language='javascript'&gt;alert('test');&lt;/script&gt;" 
  </code></pre>
  
  <p>to my post form of course it executes the javascript alert !</p>
  
  <p>I tried adding the <code>html_safe</code> both before saving and before displaying but it didn't fix anything.</p>
  
  <p>If I have to add any security code, will I have to add it before saving the post or before displaying it ? I heard that rails 3 was doing it itself so I didn't bother too much about security but I guess still there are some main things to be careful with.</p>