https://unaaldia.hispasec.com/2009/11/cross-site-scripting-en-ruby-on-rails-2.html