Escape URL in rails

I have a commenting system where people can leave a comment together with their website. Since rails now escapes everything by default I don't really do anything to avoid XSS and it works find - almost. For some reason the URL isn't escaped.

In order to display the username I have a simple helper:

def display_name(name, site)
  if !site.blank?
    return link_to(name, site)
  else
    return name
  end
end

But if you put something like javascript:alert(1) into the website field it get injecte开发者_C百科d directly into the page - any idea how to escape this?

Even if you escape javascript, malicous users could still create URLs which point to, say, delete urls that could potentially affect a user's data. Why not verify the URL as such when you collect it?

validates :attribute, :url => true

I'd recommend using Thong Kuah's UrlValidator.