sql_injection.rb

class MoviesController
  def search
    movies = Movie.where("name = '#{params[:title]}'") # UNSAFE!
    # movies = Movie.where("name = ?", params[:title])   # safe
  end
end