How not to handle HTML escaping in Ruby on Rails.

html_safe.rb

# Found this in our codebase the other day. Our contractor couldn't figure out how to
# escape html for ouput, so he overrode a Ruby-on-Rails builtin and disabled HTML-injection
# protection for the entire website.

class Object
  def html_safe?
    true
  end
end

class String
  def html_safe?
    true
  end
end