fixing active_record vunerability