User input interpolated directly into an ActiveRecord where clause allows SQL injection.
Use parameterized queries with placeholders such as where("col = ?", value).