XSS - Cross Site Scripting

XSS is a problem whereby input from users or other applications makes the application behave in unexpected ways. This is done by inputting malicious code within the text. The solution is to escape all text so that it is treated as pure text and not html.

In most Ruby on Rails tutorials you will see code like this:

<%= page.body %>

The text in page.body is written to the web page without any escaping which means that someone can type in the body tag some spurious html which will be run when accessing the data.

To HTML escape data add an "h" inside the output tag:

<%=h page.body %>

The h function replaces all html tags with their text equivalent so they are not treated as html.