This isn't an in-band signaling error, per se. This is not an issue of escaping the quotes or something, rather the way this issue works is that User.find_by_username(params[:username]) is interpreted wildly differently if params[:username] is a string compared to if it is a different data type. If it is not a string, then the "options" for the dynamic finder are automatically extracted. It turns out that you probably don't want to leave it up to your user to decide if that param should be a string or a more complex data type...

for instance, before this patch you could do User.find_by_username('whocares', :conditions=>"ARBITRARY SQL")