Avoid html_safe with Tag Helpers, safe_join, and sanitize

When you need to build HTML outside of a template, it’s tempting to concatenate strings and call html_safe on the result. This bypasses Rails’s built-in XSS protection entirely: any user input in that string goes straight to the browser unescaped. The good news is you almost never need html_safe . Rails provides three underappreciated tools that handle escaping for you. Instead of… …calling…