Since escape_html_entities_in_json was moved to 3-2-stable, make it true in AS, closes #6287

activesupport/lib/active_support/json/encoding.rb

@@ -136,7 +136,7 @@ module ActiveSupport
       end
 
       self.use_standard_json_time_format = true
-      self.escape_html_entities_in_json  = false
+      self.escape_html_entities_in_json  = true
       self.encode_big_decimal_as_string  = true
     end
   end

railties/lib/rails/generators/rails/app/templates/config/application.rb

@@ -44,9 +44,6 @@ module <%= app_const_base %>
     # Configure sensitive parameters which will be filtered from the log file.
     config.filter_parameters += [:password]
 
-    # Enable escaping HTML in JSON. The default is false.
-    # config.active_support.escape_html_entities_in_json = true
-
     # Use SQL instead of Active Record's schema dumper when creating the database.
     # This is necessary if your schema can't be completely dumped by the schema dumper,
     # like if you have constraints or database-specific column types.