title: How to safely pass parameters to ActiveRecord#select() when using PostgreSQL
body: <p>I have a method that takes a column name and defines a scope on my model. The scope makes use of PostgreSQL window functions (like rank() and row_number()), adding an additional column to the resulting dataset. For example, <code>User.ranked_on_score</code> should add a <code>rank()</code> column aliased as <code>score_ranking</code>.</p>
  
  <p>Currently, I achieved it with simple string interpolation (pseudocode): </p>
  
  <pre><code>window_alias = "#{attr}_rankings"
  result_alias = "#{attr}_ranking"
  
  select("users.*, #{window_alias}.#{result_alias}")
  .join("JOIN (SELECT id, rank() OVER (ORDER BY #{attr} ASC) as #{result_alias} ...")
  </code></pre>
  
  <p>Considering, the scope should be defined be a macro beforehand and doesn't take input from users, this approach should be safe; nevertheless, I don't like it.</p>
  
  <p>I know about the <code>sanitize_sql</code> method, but it doesn't work in my case. It wraps parameters in single quotes which is fine in the <code>WHERE</code> clause, but raises syntax errors if used in the <code>SELECT</code> clause (PG requires identifiers to be wrapped in double quotes).</p>
  
  <p>Is there any built-in method for identifier sanitization? Or should I just leave it like that?</p>