CaseCloner is not used in a situation where the p_id would come from an untrusted user, no, and it probably won't ever be. 

It's probably worthwhile to use a bind parameter for consistency, though it will mean that I can't use `AR::B.connection.select_all` — bind parameters were not supported on the low-level direct query methods last time I checked.