Check new function for SQL injection / XSS

Complete.
Checked SQL injection.
Validated that I'm using a rails finder that escaped any special SQL so I'm ok.
Also XSS generally on all pages with user content.
escapes are ok, everything is using h or sanitize