What is the most destructive thing you could assign to params?

danger_controller.rb

def string_to_camelcase(string)
  string.gsub(/\s+/, "").camelize  # camelize defined in Rails API
end

the_class = eval string_to_camelcase(params[:user_input])
the_object = the_class.new(params[:more_user_input],params[:even_more_user_input])

Also, I may try to impose a whitelist approach of what I want to allow:

string.gsub(/[^\w:]+/, '').camelize.constantize)

Agreed, no need for eval at all here... constantize gets the job done with less risk. Great comments. Thanks again!