title: Rails 3 Dynamic Escaped Query wrong number of bind variables
body: <p>I have a table where the user can filter in a variety of ways using many different types of combinations. With all the input data I'm getting from the user it was important for me to escape the user data from the SQL which leads into the problem that I'm now having. I have two arrays that are dynamically built based on the params sent to the action, one array contains the SQL clauses and the other contains the values to be paired with it's respective caluse... so for instance...</p>
  
  <pre><code>def results
  
    sql_clauses = Array.new
    sql_args = Array.new
  
    unless params[:elapsed_time].nil?
      sql_clauses &lt;&lt; "elapsed_time = ?"
      sql_args &lt;&lt; params[:elaped_time] 
    end
    unless params[:age_greater_than].nil?
      sql_clauses &lt;&lt; "age &gt; ?"
      sql_args &lt;&lt; params[:age_greater_than]
    end
    .....
    @results = Model.where(sql_clauses.join(" and "), sql_args.join(", "))
  
  end
  </code></pre>
  
  <p>Now this sends the sql_clauses array to the where method no problem. But it bombs out on the second argument because it returns a single string and it's expecting individual variables in correspondence with each of the "?" fields that appear in the sql_clauses array. I've tried the solutions offered by KandadaBoggu on <a href="https://stackoverflow.com/questions/3251919/combine-arrays-of-conditions-in-rails">Comine arrays of conditions in rails</a>. Neither of these options worked for me though but it might be because I'm using 2 arrays instead of 1.</p>
  
  <p>Does anybody know of a solution to my problem? </p>