Is this SQL statement vulnerable to SQL injection?

Question

My index action is

def index
  @users = User.without_user(current_user)
end

where without_user is a scope

scope :without_user, lambda {|user| where("id <> :id", :id => user.id) }

I was wondering if this is the most secure way to implement this or is it vulnerable ?

Answer 1

It looks good, here sql injection will not work

Note Additional, In Rails 4, you can use not syntax:

scope :without_user, lambda {|user| where.not(id: user.id) }

Answer 2

looks fine. If the data is interpolated then it should be safe which looks like the case here.