Just to expand on what others have already said...Rails converts params to http://api.rubyonrails.org/classes/ActiveSupport/HashWithInd... which means that `params[:foo]` and `params["foo"]` will both return the same thing. The function [`assert_valid_keys`](http://api.rubyonrails.org/classes/Hash.html#method-i-assert...), which is called in [`apply_finder_options`](http://api.rubyonrails.org/classes/ActiveRecord/SpawnMethods...) does not, however, treat symbol and string keys as the same, even if given a `HashWithIndifferentAccess`.

No, it's a bit more elaborate than that. If what you said were strictly true you could DoS any Rails app as symbols are never garbage collected - you could just continue sending new param keys to the app until it runs out of memory.

If I submit a form where the param is "login[select]=* from users limit 1 --" when I inspect params[:login] I get {"select"=>"* from users limit 1 --"}. Is there a different way of submitting things that converts it to symbols? params[:login] works due to it being a HashWithIndifferentAccess

The param keys remain strings underneath.