SQL Injection

AnyModel.where("id=#{query_id}")
#should be
AnyModel.where( "id= ?", query_id)

Reference

• Avoid SQL Injection