Fix sql injection vulnerability with Rails find_by_* calls

The fix is to convert the params into string before calling find_by_* functions