The `strip tags()` function in Action View returns sanitized output marked as `html safe`, but the underlying sanitizer only encodes &, <, and >, leaving double quotes (") and single quotes (') unencoded. Since ERB does not escape strings marked as `html safe`, untrusted input processed by `strip tags()` and rendered within a quoted HTML attribute (such as a title attribute or a `<meta content>` tag) can allow an attacker to close the attribute and inject new attributes, potentially leading to Cross-Site Scripting (XSS), which is a technique used to inject malicious scripts into web pages. Output rendered as element content is not affected.