title: Rails brakeman warning of sql injection
body: <p>I've got a scope in my model :</p>
  
  <pre><code>scope :assigned_to_user, -&gt;(user) {
  task_table = UserTask.table_name
  
      joins("INNER JOIN #{task_table}
            ON  #{task_table}.user_id = #{user.id}
            AND (#{task_table}.type_id = #{table_name}.type_id)
            AND (#{task_table}.manager_id = #{table_name}.manager_id)
          ")
  }
  </code></pre>
  
  <p>So after running brakeman report I get this warning :</p>
  
  <pre><code>assigned_to_user | SQL Injection | Possible
  </code></pre>
  
  <p>So I tried the following :</p>
  
  <pre><code>scope :assigned_to_user, -&gt;(user) {
      task_table = UserTask.table_name
  
          joins(ActiveRecord::Base::sanitize("INNER JOIN #{task_table}
                ON  #{task_table}.user_id = #{user.id}
                AND (#{task_table}.type_id = #{table_name}.type_id)
                AND (#{task_table}.manager_id = #{table_name}.manager_id)
              "))
      }
  </code></pre>
  
  <p>This doesn't work for me because it adds <code>'</code> (apostrophe) to the front and back of the sql. So when I use this as a part of query which returns some results and I apply this scope it generates the incorrect sql.</p>
  
  <p>I also tried this:</p>
  
  <pre><code>scope :assigned_to_user, -&gt;(user) {
      task_table = UserTask.table_name
  
          joins("INNER JOIN #{task_table}
                ON  #{task_table}.user_id = ?
                AND (#{task_table}.type_id = #{table_name}.type_id)
                AND (#{task_table}.manager_id = #{table_name}.manager_id)
              ", user.id)
      }
  </code></pre>
  
  <p>Doesn't even build the statement. And tried couple of other stuff which didn't work and not even worth mentioning. Does anybody have idea how to fix this?</p>