Encode URL parameters in JavaScript
Last week I had the fun of trying to fix what appeared to be random InvalidAuthenticityToken exceptions coming from a page using Ajax requests. I eventually tracked the problem down to this snippet of JavaScript (and in my defence I didn't write the code, honest!):
