Fix for SQL injections, use ActiveRecord querying