ejschmitt/delayed_job_web — pull request #52 by toolmantim (2014-03-07 00:03:37+00:00)
Title: Fix queues param SQL injection

Currently the `@queues` variable is populated from the params, and is then used to create a SQL string that is passed directly to the database. This allows you to execute arbitrary SQL statements from the query string.

This changes the SQL query generation to use standard `ActiveRecord::Base#where` methods, which are built to handle such things.