Hacker News Reader

That sounds like a recipe for disaster, if that's the only thing you're relying on for input validation of #{id}.

what do you mean. "wefwkefjwe'".to_i will goto zero every time. How is sql injection possible if I to_i your string?

Wouldn't it be better to not even run the query if id is a non-integer value, or does id = 0 have some intrinsic meaning in your data?