How severe is sql injection via string interpolation in where?

Shield rates this critical (CVSS 9.8), classified as CWE-89.

Rules / Ruby

SHIELD-RUBY-001

SQL injection via string interpolation in where

criticalRubyCWE-89CVSS 9.8

User input interpolated directly into an ActiveRecord where clause allows SQL injection.

Use parameterized queries with placeholders such as where("col = ?", value).

Vulnerable — Shield flags thisusers_controller.rb

class UsersController < ApplicationController
  def search
    @users = User.where("name = '#{params[:name]}'")
    render json: @users
  end
end

Fixed — scans cleanusers_controller.rb

class UsersController < ApplicationController
  def search
    @users = User.where("name = ?", params[:name])
    render json: @users
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-001, the fixed one does not.