title: How to fix sql injection in order rails query
body: <p>Im new to ruby and followed <a href="https://www.cloudsecuretech.com/how-to-fix-the-sql-injection-vulnerability-in-ruby-on-rails/" rel="nofollow noreferrer">this</a> blog  to fix sql injection bug but my query is giving error .</p>
  <p><strong>Original query :</strong></p>
  <pre><code>class Car &lt; ActiveRecord::Base
    ...
    has_one :Driver, lambda {
       where(status: PASSENGER_STATUS, connected_number: [phone, mobile])
      .order(&quot;FIELD (`classDummy`.`status`, #{PASSENGER_STATUS.join(', ')}&quot;)
    }, class_name: :classDummy
  </code></pre>
  <p>Whereas , PASSENGER_STATUS is ( in other class )</p>
  <pre><code>PASSENGER_STATUS = [
    'employed','temporary'
    ].freeze
  </code></pre>
  <p><strong>SQL INJECTION fix I did</strong></p>
  <pre><code>  order(&quot;FIELD (`classDummy`.`status`, ? )&quot;, PASSENGER_STATUS.join(', '))
  </code></pre>
  <p>But this is throwing exception while executing query.</p>
  <p>Exception that Im getting :</p>
  <blockquote>
  <p><strong>ActiveRecord::StatementInvalid: Mysql2::Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL
  server version for the right syntax to use near '?,</strong></p>
  </blockquote>