Should using rails dynamic query, or question mark in query condition, to prevent SQL injection.