That SQL logic totally should not be in the controller (and it's creepy also)