xss_protection.rb

<%#= '<script>alert("Hii")</script>' %> 
<!--The above will escape by default-->

<%#= '<script>alert("Hii")</script>'.html_safe  %>
<!--The above will alert Hii because we are marking the string as safe.-->

<%#= h('<script>alert("Hii")</script>')  %>
<!--Its same as the first one.-->

<%#= raw('<script>alert("Hii")</script>')  %>
<!--The above will alert Hii because raw = "".to_s.html_safe-->


<%= sanitize '<script>alert("Hii")</script>' %>
<!--removes the script tag and prints alert("Hii") -->