rails/rails — pull request #14261 by MSch (2014-03-03 16:52:40+00:00)
Title: Make exists? use bound values.

When we build a query with an inline value that is a `numeric` (e.g.
because it's out of range for an `int4`) PostgreSQL doesn't use an index
on the column, since it's now comparing `numeric`s and not `int4`s.

This leads to a _very_ slow query.

When we use bound parameters instead of inline values PostgreSQL
raises `numeric_value_out_of_range` since no automatic coercion happens.

This is relevant because otherwise user-supplied input (`params[:id]`) can DOS the database.