XSS & Active Record

[eluser]Benito[/eluser]
Well the answer is yes and no. Some characters do get rendered in certain situations. Rule of thumb is to always treat user input as potentially dangerous and filter it for unwanted patterns and characters. Or you can change the logic around and only allow certain characters like

Code:

<br />, <span>, <p>

etc. but you must let your users know that all other characters will be filtered and removed ahead!
I would also encourage to read this XSS patterns article on ha.ckers.org. It has some very clear points on the topic from which I learnt a lot anno.
Cheers