up until very recently, no templating language provided XSS protection by default. Rails sample code you see in the various tutorial for example still is full o

up until very recently, no templating language provided XSS protection by default. Rails sample code you see in the various tutorial for example still is full of <h1><%= title %></h1> which for all versions of rails < 3 is an open door for an XSS attack. PHP had a filter extension that helps with this for ages, but it's not on by default and not widely used by the various projects which hope/need to still run on up to 10 years old versions of PHP. We'll see how the common Rails user will react to all text injected into ERB being escaped by default. I'm sure this will cause rants like http://news.ycombinator.com/item?id=1162122 http://news.ycombinator.com/item?id=1162122 which was complaining that ruby 1.9's string handling became "so complicated". "but... I just want to allow the user to type HTML and to display it - why do I have to go all these lengths to accomplish that?"