Rewriting sql query <p>I have where clause in my rails app that looks like this:</p> <pre><code>Report.where("lower(coalesce(#{organization_tables_with_name.join(',')})) LIKE lower(?)","%#{organization_name}%") </code></pre> <p>it works as expected but this code is vulnerable to sql injection. I rewrite this to something like that:</p> <pre><code>Report.where("lower(coalesce(?)) LIKE lower(?)", organization_tables_with_name,"%#{organization_name}%") </code></pre> <p>but this not works. The problem is that after sending to coalesce paremeter it makes quotes around it:</p> <pre><code>WHERE(lower(coalesce('k12_seas.name,k12_leas.name,k12_schools.name,k12_sections.name')) </code></pre> <p>but it should be:</p> <pre><code>WHERE (lower(coalesce(k12_seas.name,k12_leas.name,k12_schools.name,k12_sections.name)) </code></pre> <p>how can I solve this problem?</p>