title: Rails ActiveRecord sanitize_sql replaces ? in string
body: <p>I have a plain SQL query written by a trusted administrator that is to be run in a Rails (4.2) app. I am sanitizing it with <code>ActiveRecord::Base.send(:sanitize_sql, ...)</code> to allow user inputs to act as conditions, using the <code>?</code> character for bind variables. The code has to allow arbitrary SQL, so I'm not interested in the arguments about why this is not the Rails way, etc. </p>
  
  <p>The problem is that I can not include <code>?</code> in a result field in the SQL without the underlying <code>replace_bind_variables</code> method replacing an intended literal <code>?</code> in the result.</p>
  
  <p>A simple query for example would be:</p>
  
  <pre><code>select 'http://www.google.com?q=' || res from some_table where a = ?;
  </code></pre>
  
  <p>To sanitize:</p>
  
  <pre><code>ActiveRecord::Base.send(:sanitize_sql, [sql, 'not me'], :some_table)
  </code></pre>
  
  <p>The sanitization fails because the <code>?</code> in the URL gets replaced with the data intended for the condition, leading to the exception:</p>
  
  <pre><code>ActiveRecord::PreparedStatementInvalid: wrong number of bind variables (1 for 2)
  </code></pre>
  
  <p>The question is, does <code>sanitize_sql</code> or some variant allow literal <code>?</code> characters to be included in a query so that they are not replaced? Is there some way of escaping them?</p>