using a placeholder with joins

I'm attempting to avoid any SQL injection vulnerabilities by substituting with my params on a join. Category.joins("LEFT OUTER JOIN incomes ON incomes.category_id = categories.id AND incomes.dept_id = ?", params[:Dept]) This attempts to execute the query with a question mark in it, instead of substituting it for the param. What is the proper way to do this? EDIT: Query needs to return this: SELECT