I am working on a query and am using `exec_query` with binds to avoid potential SQL injection. However, I am running into an issue when trying to check that an id is in an array.

```sql
SELECT JSON_AGG(agg_date)
FROM (
 SELECT t1.col1, t1.col2, t2.col1, t2.col2, t3.col3, t3.col4, t4.col7, t4.col8, t5.col5, t5.col6
 FROM t1
 JOIN t2 ON t1.id = t2.t1_id
 JOIN t3 ON t1.id = t3.t3_id
 JOIN t4 ON t2.is = t4.t2_id
 JOIN t5 ON t3.id = t5.t3_id

 WHERE t2.id IN ($1) AND t4.id = $2
) agg_data

```

this gives an error of `invalid input syntax for integer: '1,2,3,4,5'`

And `SELECT ... WHERE t.id = ANY($1)` gives `ERROR: malformed array literal: "1,2,3,4,5,6,7" DETAIL: Array value must start with "{" or dimension information.`

If I add the curly braces around the bind variable I get  `invalid input syntax for integer: "$1"`

Here is the way I'm using `exec_query`

```rb
connection.exec_query(<<~EOQ, "-- CUSTOM SQL --", [[nil, array_of_ids], [nil, model_id]], prepare: true)
  SELECT ... WHERE t.id IN ($1)
EOQ

```

I have tried with plain interpolation but that throws brakeman errors about sql injection so I can't use that way :(

Any help on being able to make this check is greatly appreciated. And if `exec_query` is the wrong way to go about this, I'm definitely down to try other things :D

In my class, I am using AR's internal sql injection prevention to search for the first bind variable ids, then plucking the ids and joining into a string for the sql query. I am doing the same for the other bind variable, finding the object and using that id. Just as a further precaution. So by the time the user inputs are used for the query, they've been through AR already. It's a brakeman scan that it throwing the error. I ahve a meeting on monday with our security team about this, but wanted to check here also :D