This permits SQL injection. User data should never be interpolated into the keys of a find condition.