title: Rails, how to sanitize SQL in find_by_sql
body: <p>Is there a way to sanitize sql in rails method <code>find_by_sql</code>?</p>
  
  <p>I've tried this solution:
  <a href="https://stackoverflow.com/questions/2497757/ruby-on-rails-how-to-sanitize-a-string-for-sql-when-not-using-find">Ruby on Rails: How to sanitize a string for SQL when not using find?</a></p>
  
  <p>But it fails at</p>
  
  <pre><code>Model.execute_sql("Update users set active = 0 where id = 2")
  </code></pre>
  
  <p>It throws an error, but sql code is executed and the user with ID 2 now has a disabled account.</p>
  
  <p>Simple <code>find_by_sql</code> also does not work:</p>
  
  <pre><code>Model.find_by_sql("UPDATE user set active = 0 where id = 1")
  # =&gt; code executed, user with id 1 have now ban
  </code></pre>
  
  <p><strong>Edit:</strong></p>
  
  <p>Well my client requested to make that function (select by sql) in admin panel to make some complex query(joins, special conditions etc). So I really want to find_by_sql that.</p>
  
  <p><strong>Second Edit:</strong></p>
  
  <p>I want to achieve that 'evil' SQL code won't be executed.</p>
  
  <p>In admin panel you can type query -> <code>Update users set admin = true where id = 232</code> and I want to block any UPDATE / DROP / ALTER SQL command.
  Just want to know, that here you can ONLY execute SELECT.</p>
  
  <p>After some attempts I conclude <code>sanitize_sql_array</code> unfortunatelly don't do that.</p>
  
  <p>Is there a way to do that in Rails??</p>
  
  <p>Sorry for the confusion..</p>