Comment by jewel

This has security implications! Example exploitable ruby code:

  unless person_id =~ /^\d+$/
    abort "Bad person ID"
  end
  sql = "select * from people where person_id = #{person_id}"

In addition to injection attacks, this also can bite people when parsing headers, where a bad header is allowed to sneak past a filter.