Rails changed the default to safe output about three years ago. 3.0 escaped output out of the gate, and 2.3 switched the default in the 2.3.6 neighborhood.

Prior before that, the standard way to sanitize html output was to write <%= h foo %> instead of <%= foo %> in your templates.