title: Are the .order method parameters in ActiveRecord sanitized by default?
body: <p>I'm trying to pass a string into the .order method, such as</p>
  
  <pre><code>Item.order(orderBy)
  </code></pre>
  
  <p>I was wondering if orderBy gets sanitized by default and if not, what would be the best way to sanitize it.</p>