Use form_tag to address security concerns.