@medina @estolfo The problem with using `tainted?` here is that it won't catch the hash scenario which was the core issue brought up. `ActionController::Parameters` itself is not tainted, and any hash nested within it is also an `ActionController::Parameters`. So for example if I sent a request like:

```
http://localhost:3000/users?test[value]=hi
```

In the controller, here's what these are:

```ruby
params.tainted? #=> false
params[:test].tainted? #=> false
```

It's looking to me that there's really not a *generic* solution, and maybe this causes more problems/concerns then forcing people to just secure their apps manually.