title: How to execute arbitrary parameterized SQL in rails
body: <p>For performance reasons, I need to write a new method in my Rails model that executes some arbitrary SQL:</p>
  
  <pre><code>UPDATE table
     SET col1 = ? AND col2 = ?
     WHERE id = ?
  </code></pre>
  
  <p>I understand I can use <code>ActiveRecord::Base.connection.execute</code> or <code>ActiveRecord::Base.connection.update</code> with a string of SQL to get the results I need, but what is the proper procedure for substituting the parameter placeholders (<code>?</code>) with the actual parameter values? Is there a Rails method for interpolating parameters into a SQL statement, or should it just be done by manual interpolation? The latter seems unsafe...</p>