title: Parameterizing SQL queries in Ruby + TinyTDS
body: <p>I am trying to figure out how to parameterize an SQL string before handing it off to be executed, but sadly I find a lot <a href="http://evilmathemagician.blogspot.com/2011/08/ruby-tutorial-sql-query-to-console-ie.html">of this</a> on the internet:</p>
  
  <pre><code>sql = "SELECT * FROM table_name WHERE thing LIKE '%#{input}%'"
  </code></pre>
  
  <p>Which is a bad thing...however, parameterizing sql queries is available in the underlying <a href="http://sequel.rubyforge.org/rdoc/files/doc/prepared_statements_rdoc.html">Sequel</a> library, which is what TinyTDS is built on top of. So I know it's possible. I am just having a hard time figuring it out.</p>
  
  <p>I really wish it could be as simple as <a href="http://rosettacode.org/wiki/Category%3aRuby">this</a>:</p>
  
  <pre><code>@client = TinyTds::Client.new(
        :adapter =&gt; 'sqlserver',
        :host =&gt; host,
        :database =&gt; db,
        :username =&gt; username,
        :password =&gt; password)
  
  sql = "SELECT * FROM table_name WHERE thing LIKE ?"
  safe_sql = @client.prepare(sql, input)
  result = @client.execute(safe_sql)
  </code></pre>
  
  <p>I seem to have found something called a <a href="https://github.com/jeremyevans/sequel/blob/master/lib/sequel/adapters/tinytds.rb#L258"><code>Dataset</code></a> class in the sourcecode, which has a prepare method. The question is, how do I use it? Do I need to create another object before handing it off to the <code>execute()</code> method in the <code>@client</code> object? I couldn't find an <code>initialize</code> or a <code>new</code> method, so simple instantiation seems like the wrong way to go.</p>