I think we could switch this one with Ruby's native CGI::escape_html(str)
http://www.ruby-doc.org/stdlib-1.9.2/libdoc/cgi/rdoc/CGI.html#method-c-escape_html