RedCloth & filter_html

[Majglow]

Hello,

I'm trying to use RedCloth to allow users to format comments without creating security vulnerabilities. I have filter_html enabled and it filters out everything except when the user submits something like:

<a href="javascript:_______">Danger Link</a>

Is there any way to filter that out?

[Fenrir2]

Use sanitize:

<%= sanitize(@comment.text) %>

http://railsmanual.com/module/Action...elper/sanitize