title: Best way to sanitize JSON from Rails
body: <p>RoR 3 automagically sanitizes ERB templates (when done correctly). However, I've got a little project where I'm using RoR for the application tier only and javascript for the presentation. So, typical request is ajax call to rails route and render returned json. Issue is it is currently possible for me to inject js, create a new product with title <code>&lt;script&gt;alert('hello')&lt;/script&gt;</code> and this is returned as is on the next request and the browser happily interprets the script.</p>
  
  <p>Is it best to</p>
  
  <ol>
  <li>sanitize the inputs on post?</li>
  <li>sanitize the json response on the server? (override to_json?)</li>
  <li>sanitize the json response on the client?</li>
  </ol>
  
  <p>I appreciate any input.</p>