ruby on rails - How to safely pass parameters to ActiveRecord#select() when using PostgreSQL -

i have method takes column name , defines scope on model. scope makes use of postgresql window functions (like rank() , row_number()), adding additional column resulting dataset. example, user.ranked_on_score should add rank() column aliased score_ranking.

currently, achieved simple string interpolation (pseudocode):

window_alias = "#{attr}_rankings" result_alias = "#{attr}_ranking"  select("users.*, #{window_alias}.#{result_alias}") .join("join (select id, rank() on (order #{attr} asc) #{result_alias} ...") 

considering, scope should defined macro beforehand , doesn't take input users, approach should safe; nevertheless, don't it.

i know sanitize_sql method, doesn't work in case. wraps parameters in single quotes fine in where clause, raises syntax errors if used in select clause (pg requires identifiers wrapped in double quotes).

is there built-in method identifier sanitization? or should leave that?

have tried quote_column_name? it's undocumented reason, should need.

window_alias = quote_column_name("#{attr}_rankings") result_alias = quote_column_name("#{attr}_ranking") 

under hood, it's equivalent calling pgconn.quote_ident when using postgresql.