activerecord - Rails SQL Injection safe SELECT fields -

i have following ruby on rails code:

#the user can ask subset of following columns: authorized_fields= ["id","created_at","updated_at"]  #the user sends requested columns comma separated string in fields param fields = (params[:fields].split(',') & authorized_fields).join(",");  #build query run: sql = "select json_agg(u) (select #{fields} table_name) u"  #run query against database modelname.connection.select_value(sql) 

my question is, query sql injection safe? understanding since limit available fields, protects me injections.

am correct? can give me example of fields parameter sent user not safe?

you may use activerecord::base.connection.quote_column_name. code should this:

input_fields = params[:fields].split(',').collect |field|    activerecord::base.connection.quote_column_name(field)  end