title: How to Sanitize the SQL in Rails?
body: <p>I'm new to this RoR world,</p>
  
  <p>I've many SELECT sql queries in my RoR Application, something like this</p>
  
  <pre><code>@replies  = Offerreply.find_by_sql ("SELECT * FROM offerreplies WHERE 
  offer_id="+params [:offer_id])
  </code></pre>
  
  <p>Some are very simple like above and some are very complex JOINS. most of them are suffering from <strong>SQL Injection</strong>  problem. So., How to Sanitize such SQL statements in RoR?</p>
  
  <p>Edit: How to Handle same in SQL statements which has JOINS and Sub-queries? something like this</p>
  
  <pre><code>@to_be_approved=Beneficiary.find_by_sql("SELECT * FROM beneficiaries WHERE project_id="+params[:id]+" AND NOT id IN (SELECT beneficiaries.id FROM beneficiaries INNER JOIN beneficiaryloans ON beneficiaryloans.beneficiary_id=beneficiaries.id AND beneficiaryloans.hfi_id="+session[:id].to_s+" AND beneficiaries.status_id=4) AND cso_id IN(SELECT user_id FROM user_projects INNER JOIN users ON  user_projects.user_id=users.id AND users.user_type_id=2)")
  </code></pre>