fix SQL injection, generate new report via brakeman