title: Is a given sql statement vulnerable to a sql injection attack?
body: <p>I'm building a sql statement like the one below in a rails app :-  </p>
  
  <pre><code>bank_ids = params[:bank_ids] # comes from end user or simply, is a user input.  
  
  sql_string = "SELECT * FROM users WHERE bank_id IN (#{bank_ids});"  
  </code></pre>
  
  <p>Is the sql statement above vulnerable to an injection attack, input 'bank_ids' is end user controlled.</p>