Use CGI for escaping, instead of to_query, which requires ActiveSupport