covered ActiveRecord SQL injection