There is no parameter $1 ...Sending SQL statement to Rails for Postgresql, what am I doing wrong? -

activerecord::base.connection.execute(           "with numberofdays            (select percent_change asset_histories            date < $1           , asset_symbol = $2           order date desc           limit $3)           select stddev_samp(percent_change) stdev numberofdays",           [day,symbol,daystolimit]) 

where day, symbol , daystolimit variables assigned before above code. assigned such:

day = '2013-03-25' symbol = 'aapl' daystolimit = 20 

i don't want use #{variable} because of potential malicious intent. referenced in title, statement returning

pgerror error: there no parameter $1 line 1 ... date <$1 and...

using postgresql 9.2 , rails 3.2

edit adding alternative solution found here:

in addition mu short uses connection.method(:quote), couldn't find documentation on came across post quoting done such:

a = activerecord::base.connection a.execute(%q{select * table id = #{a.quote(variable)}...}) 

from fine (?) manual:

execute(sql, name = nil)

executes sql statement, returning pgresult object on success or raising pgerror exception otherwise.

note second parameter isn't binding parameters, name (afaik) logging purposes.

activerecord doesn't use bound parameters internally, quoting , escaping , builds big sql string database (cringe). can mimic behavior using quote method , string interpolation:

q = activerecord::base.connection.method(:quote) activerecord::base.connection.execute(%q{     numberofdays      (select percent_change asset_histories      date < #{q[day]}     , asset_symbol = #{q[symbol]}     order date desc     limit #{daystolimit})     select stddev_samp(percent_change) stdev numberofdays }) 

you'll have ensure daystolimit number on own (or quote , cast integer inside sql).

alternatively, connect database using raw pg interface , use real prepared statments.