title: Sanitizing a Stored Procedure Call in SQL Statement
body: <p>I'm working in Rails, ActiveRecord, and Postgresql, and am attempting to sanitize a SQL statement that executes a stored procedure:</p>
  
  <pre><code>query =&lt;&lt;-SQL
      SELECT *
      FROM #{stored_procedure_name}
      (
          #{param_1},
          #{param_2}
      )
  SQL
  </code></pre>
  
  <p>The above statement works when executed. From what I understand, the stored procedure should be sanitized at the database layer because of parametrization (due to the way I defined the function). However, how can I sanitize the <code>query</code> above? I tried ActiveRecord's <code>sanitize</code> methods to no avail by using something like</p>
  
  <pre><code>statement =&lt;&lt;-SQL
      SELECT * FROM ? (?, ?)
  SQL
  </code></pre>
  
  <p>and then passing the parameters in, but this didn't work - and seems silly.</p>