Check for SQL injection in pluck method

[ActiveRecord::Calculations#pluck](http://api.rubyonrails.org/classes/ActiveRecord/Calculations.html#method-i-pluck) will happily accept SQL for no good reason.