Many of the connection query methods that come with ActiveRecord accept an optional binds parameter. This can be used to safely inject parameters into the query.