Backported fix for CVE-2012-5664

Options hashes should only be extracted if there are extra
parameters. Fixed Versions: 3.2.10, 3.1.9 and 3.0.18.

https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM
Merge pull request #11 from opf/fix/sql-injection

Backported fix for CVE-2012-5664