Review

As discussed earlier, this is a SQL-injection attack point. You are interpolating the string of the property name without doing any escaping. The "val" values will be escaped, but a malicious user could change the name of a property parameter to attempt an attack, as well as send in special values.

Use Arel to build the query instead - @dogs.where(property: val)

You might also want to move this finder into the model as ```def find_by_search_criteria(hash)``` or similar