How good is the Rails sanitize() method?
- by Horace Loeb
Can I use ActionView::Helpers::SanitizeHelper#sanitize on user-entered text that I plan on showing to other users? E.g., will it properly handle all cases described on this site?
Also, the documentation mentions:
  Please note that sanitizing
  user-provided text does not guarantee
  that the resulting markup is valid
  (conforming to a document type) or
  even well-formed. The output may still
  contain e.g. unescaped ’<’, ’’, ’&’
  characters and confuse browsers.
What's the best way to handle this? Pass the sanitized text through Hpricot before displaying?