Am I the only one who does not understand what is this about? Oh, no, looks like rails team does neither. Stupid code can be written in any framework/language. How much experience does one need to understand a simple rule - _never_ use user input directly. If you have an urge to trust your users - I'd suggest better way: `params[:command]`