module ActiveRecord::Sanitization::ClassMethods

def sanitize_sql_array(ary)

["name='%s' and group_id='%s'", "foo'bar", 4] returns "name='foo''bar' and group_id='4'"
sanitized and interpolated into the SQL statement.
Accepts an array of conditions. The array has each value 
def sanitize_sql_array(ary)
  statement, *values = ary
  if values.first.is_a?(Hash) && statement =~ /:\w+/
    replace_named_bind_variables(statement, values.first)
  elsif statement.include?('?')
    replace_bind_variables(statement, values)
  elsif statement.blank?
    statement
  else
    statement % values.collect { |value| connection.quote_string(value.to_s) }
  end
end