XSS protection in number_to_currency number helper

The Unit option is not protected against XSS, the input should be sanitized