README.md in scrub_params-0.0.2 vs README.md in scrub_params-0.0.3

- old
+ new

@@ -1,24 +1,24 @@ # Scrub Params -:lock: Secure Rails parameters by default +:lock: Safer Rails parameters by default -HTML has no business in most parameters. Take the **whitelist approach** and remove it by default. +JavaScript and HTML have no business in most parameters. Take the **whitelist approach** and remove them by default. -**Note:** Rails has done amazing work to prevent XSS, but storing `<script>badThings()</script>` in your database makes it much easier to make mistakes. +**Note:** Rails does amazing work to prevent [cross-site scripting (XSS)](http://en.wikipedia.org/wiki/Cross-site_scripting), but storing `<script>badThings()</script>` in your database makes it much easier to make mistakes. -Works with Rails 3.2 and above. +Works with Rails 3.2 and above ## Get Started Add this line to your application’s Gemfile: ```ruby gem 'scrub_params' ``` -You now have another line of defense against [cross-site scripting (XSS)](http://en.wikipedia.org/wiki/Cross-site_scripting). +You now have another line of defense against XSS. ### Test It Submit HTML in one of your forms. @@ -38,10 +38,10 @@ Scrubbed parameters: name ``` ### Whitelist Actions -To prevent certain actions from being scrubbed, use: +To skip scrubbing for certain actions, use: ```ruby skip_before_filter :scrub_params, only: [:create, :update] ```