title: Sql Injection Prevention and Converting Data in Rails
body: <p>I noticed in the Ruby on Rails Guide that this is considered correct format</p>
  
  <pre><code>Client.where("orders_count = ?", params[:orders])
  </code></pre>
  
  <p>whereas later on they used</p>
  
  <pre><code>Client.where(:created_at =&gt; (params[:start_date].to_date)..(params[:end_date].to_date))
  </code></pre>
  
  <p>My question is, is it safe to assume that using the <code>.to_</code> method will be secure enough against sql injection?</p>