diff --git a/Gemfile.lock b/Gemfile.lock
index 95d6c65..29a4afa 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    query_helper (0.3.9)
+    query_helper (0.4.0)
       activerecord (> 5)
       activesupport (> 5)
       sqlite3
diff --git a/lib/query_helper/sql_parser.rb b/lib/query_helper/sql_parser.rb
index 86c5876..1104c87 100644
--- a/lib/query_helper/sql_parser.rb
+++ b/lib/query_helper/sql_parser.rb
@@ -18,7 +18,9 @@ def update(sql)
 
     def remove_comments
       # Remove SQL inline comments (/* */) and line comments (--)
-      @sql = @sql.gsub(/\/\*(.*?)\*\//, '').gsub(/--(.*)$/, '')
+      @sql = @sql.gsub(%r{/\*[^/]*?\*/}m, '')  # Removes multi-line comments (/* ... */)
+              .gsub(/--[^\n]*/, '')            # Removes single-line comments (--)
+
       @sql.squish!
     end
 
@@ -186,7 +188,7 @@ def find_aliases
         ColumnMap.new(
           alias_name: sql_alias,
           sql_expression: sql_expression.squish,
-          aggregate: /(array_agg|avg|bit_and|bit_or|bool_and|bool_or|boolor_agg|booland_agg|count|every|json_agg|jsonb_agg|json_object_agg|jsonb_object_agg|max|min|string_agg|sum|xmlagg)\((.*)\)/.match?(sql_expression)
+          aggregate: /\b(array_agg|avg|bit_and|bit_or|bool_and|bool_or|boolor_agg|booland_agg|count|every|json_agg|jsonb_agg|json_object_agg|jsonb_object_agg|max|min|string_agg|sum|xmlagg)\((.*)\)/.match?(sql_expression)
         ) if sql_alias
       end
       column_maps.compact
diff --git a/lib/query_helper/version.rb b/lib/query_helper/version.rb
index bf34ca1..f1c7f8d 100644
--- a/lib/query_helper/version.rb
+++ b/lib/query_helper/version.rb
@@ -1,3 +1,3 @@
 class QueryHelper
-  VERSION = "0.3.9"
+  VERSION = "0.4.0"
 end
diff --git a/spec/fixtures/controllers.rb b/spec/fixtures/controllers.rb
index 2ffb53f..2567a58 100644
--- a/spec/fixtures/controllers.rb
+++ b/spec/fixtures/controllers.rb
@@ -4,7 +4,9 @@
 class ApplicationController < ActionController::API
   include Rails.application.routes.url_helpers
   include QueryHelper::QueryHelperConcern
+  include ActionController::RequestForgeryProtection
   before_action :create_query_helper
+  protect_from_forgery with: :exception
 end
 
 class ParentsController < ApplicationController