Fix queues param SQL injection

Currently the `@queues` variable is populated from the params, and is then used to create a SQL string that is passed directly to the database. This allows you to execute arbitrary SQL statements from the query string.

This changes the SQL query generation to use standard `ActiveRecord::Base#where` methods, which are built to handle such things.