I've tried to do stuff like this
not_allowed = ['5', '6', '7']
sql = not_allowed.map{|n| "col != '#{n}'"}.join(" OR ")
Model.where(sql)
and
not_allowed = ['5', '6', '7']
sql = not_allowed.map{|n| "col <> '#{n}'"}.join(" OR ")
Model.where(sql)
but both of these just return my entire table which isn't accurate.
So I've done this and it works:
shame = values.map{|v| "where.not(:col => '#{v}')" }.join(".")
eval("Model.#{shame}")
and I'm not even doing this for an actual web application, I'm just using rails for its model stuff. So there aren't any actual security concerns for me. But this is an awful fix and I felt obligated to post this question