rails/rails — pull request #6287 by homakov (2012-05-12 16:24:19+00:00)
Title: set escaping HTML in json encoding to +true+

related #6277
@spastorino @josevalim are OK to turn it true by default
I :thumbsup: it too, this will mitigate some XSS holes - check showcases I made in that issue.
but seems @wycats didn't like this idea and proposed me to use escaping on the client side. It looks a little bit weird to me(escaping HTML on client side). I see no single reason to send smht like this {"body": "

body

"} it's definitely not the Rails way. Anyway, it's just an option that saves JSON-backend based apps from XSS and lame code either :).