Use a better HTML sanitizer that makes sure the HTML is well formed and

can add rel="nofollow" to links.

app/helpers/application_helper.rb

@@ -1,6 +1,10 @@
 module ApplicationHelper
   require 'rexml/document'
 
+  def sanitize(text)
+    Sanitize.clean(text, Sanitize::Config::OSM)
+  end
+
   def htmlize(text)
     return linkify(sanitize(simple_format(text)))
   end

config/environment.rb

@@ -53,6 +53,7 @@ Rails::Initializer.run do |config|
   config.gem 'oauth', :version => '>= 0.3.6'
   config.gem 'httpclient'
   config.gem 'SystemTimer', :version => '>= 1.1.3', :lib => 'system_timer'
+  config.gem 'sanitize'
 
   # Only load the plugins named here, in the order given. By default, all plugins
   # in vendor/plugins are loaded in alphabetical order.

config/initializers/sanitize.rb

@@ -0,0 +1,3 @@
+Sanitize::Config::OSM = Sanitize::Config::RELAXED.dup
+
+Sanitize::Config::OSM[:add_attributes] = { 'a' => { 'rel' => 'nofollow' } }