The problem occurs with templates such as in this (HAML example): - posts.each do |post| %li = link_to post.title, post_url(post), class: "p

The problem occurs with templates such as in this (HAML example): - posts.each do |post| %li = link_to post.title, post_url(post), class: "post_link" Note that in the case of Rails 2.3 (which the article describes), Rails doesn't know if post.title, post_url() or "post_link" have been escaped or not. It originates at a time when the Rails people were fairly lax and ignorant about encodings and sanitization in general. For the post.title bit, the link_to method just passes it along, assuming it's valid HTML. Which means it's an injection point if the post was user-submitted. The URL and the {class: "post_link"} are passed through escape_once, described in the article. As you can see, the amount of data that must potentially be sanitized/encoded can be a lot; lots of small pieces of text that add up to a lot of overhead. Rails 3.x fixes this by assuming that no strings contain sanitized HTML; therefore, when you insert data into a template, it will automatically escape everything. This is good. If you know that something is already sanitized, you can declare it as such: = link_to post.title.html_safe This flags the string as safe, and link_to will not need to escape it.