That Rails has an <i>escape_once</i> method is a big part of the reason I stopped using Rails. If you think "double escaping" is a problem to be solved by creating a helper method that won't escape what's already escaped, now you have two problems.<p>EDIT TO ELABORATE:<p>Problem 1 is the original problem, that parts of your code do not agree upon what a particular string represents. This is the "strings problem," the mother of XSS and injection vulnerabilities. [1]<p>Problem 2 is that the <i>escape_once</i> method papers over these problems, making them harder to detect, and preventing you from hunting down the logic errors that cause them. (Since these errors often occur in upstream code, you need to find them <i>before</i> they execute to be safe, which is why compile-time methods [2] work best.)<p>[1] <a href="http://blog.moertel.com/posts/2007-08-15-a-bright-future-security-and-modern-type-systems.html" rel="nofollow">http://blog.moertel.com/posts/2007-08-15-a-bright-future-sec...</a><p>[2] <a href="http://blog.moertel.com/posts/2006-10-18-a-type-based-solution-to-the-strings-problem.html" rel="nofollow">http://blog.moertel.com/posts/2006-10-18-a-type-based-soluti...</a>