title: How to sanitize raw SQL in Rails 4
body: <p>In Rails 3 I could use <code>sanitize_sql_array</code> to sanitize raw SQL for those occassional moments where a raw SQL query is needed. But this appears to have been removed in Rails 4, or not so much removed, but moved to ActiveRecord::Sanitization. However, I can not figure out how to call <code>sanitize_sql_array</code> now, so what's the best way to sanitize raw SQL in Rails 4?</p>
  
  <p>I want to clarify that I am talking about a full raw SQL query here, not using Rail's models. I'm aware that this is not best practice, this is just what I have to do for this specific query since it can't be represented by Rails's nice ActiveRecord interface (Trust me, I've tried).</p>
  
  <p>Here is a sample call, which is obviously simpler than what my query actually looks like:</p>
  
  <pre><code>query = "SELECT * FROM users 
  LEFT OUTER JOIN posts ON users.id=posts.user_id
  AND posts.topic_id = '#{topic.id}'" 
  # ^- Obviously bad and very vulnerable, this is what we're trying to fix
  ActiveRecord::Base.connection.select_all(query)
  </code></pre>