cyl337/hw2_rottenpotatoes — comment on commit 5341c99cfc0701d37726d15acbad102fb7ee92c8
File: app/controllers/movies_controller.rb line 17
By cyl337:

Really? But I thought string is sanitized if it is passed as a hash, according to this section in RoR guides http://guides.rubyonrails.org/security.html#sql-injection