Prevent injection attack form Redcarpet gem in rails -

i have text area allows user type in description of cars.

it saved :text , when called, render via applicationhelper below:

module applicationhelper     def markdown(text)         renderer = redcarpet::render::html         @engine = redcarpet::markdown.new(renderer,              hard_wrap: true,             filter_html: true,             autolink: true,             no_intra_emphasis: true         )         @engine.render(text)     end end 

being paranoia, tried typing in in textarea.

markdown.  __nice.__  <%= @car %> <script>   alert('damn'); </script> 

while <%= @car %> did not parse in ruby code, script indeed executed.

in view:

<%= markdown(@car.description).html_safe %> 

i wonder if right way handling redcarpet; mechanism prone attack, , how can prevent it?

best