title: Rails - how to protect against sql injection for a postgres find_by_sql query?
body: <p>I have the following find_by_sql query against a postgres DB:</p>
  
  <pre><code>pick_ids = picks.pluck(:id).join(',')
  
  Pick.find_by_sql("WITH cte1 AS (SELECT DISTINCT user_id, state, pick FROM picks 
  WHERE id IN (#{pick_ids})), cte2 AS (SELECT user_id, coalesce(sum(amount_won), 0)
  as picks_total_won FROM picks WHERE id IN (#{pick_ids}) GROUP BY user_id), cte3 AS 
  (SELECT user_id, COUNT(CASE WHEN state = 'won' then 1 ELSE null END) AS picks_won,
  FROM cte1 GROUP BY user_id) SELECT cte2.picks_total_won, cte3.picks_won,
  FROM cte2 INNER JOIN cte3 ON cte2.user_id = cte3.user_id")
  </code></pre>
  
  <p>When I try to parameterize it (i.e., ?, ?...pick_ids, pick_ids), however, I get the following error:</p>
  
  <pre><code>ArgumentError: wrong number of arguments (3 for 1..2)
  </code></pre>
  
  <p>(1) Can you parameterize a find_by_sql query like this?  If so, how?</p>
  
  <p>(2) Do you even need to worry about SQL injection if the query will never receive user-inputted params?</p>