Interpolating variables into find_by_sql builds a query vulnerable to SQL injection.
Pass an array with bind parameters to find_by_sql instead of interpolating.