title: Avoid sql injection with query by ActiveRecord::Base.connection.execute
body: <p>I need to query by the method <code>ActiveRecord::Base.connection.execute(USER_INPUT)</code></p>
  
  <p>The query string is given by <strong>USER INPUT</strong> (They can query by URL with any <code>time period</code>, <code>product_type</code> )</p>
  
  <p>How do I prevent SQL inject ? To avoid any damage for my system ? </p>
  
  <p>Is it possible to limit user can only query for <code>SELECT</code> except for <code>DELETE, TRUNCATE, INSERT, UPDATE ...</code> </p>