Rails Brakeman SQL injection warning while accessing an oracle view/function

I have rails code that is consuming an oracle view/function. This is my code:

 def run_query
    connection.exec_query(
      "SELECT * FROM TABLE(FN_REQ(#{demo_type_param},#{demo_tid_param}}))")
  end

When run Brakeman analyzer it warns of possible "sql injection attack"

I need to understand if this is a valid warning, if so, how do I remediate it?

Since this is a function & not an actual table, I am not sure what's the right way. If it was a normal model, i would have just followed this pattern:

Model.where("mycolumn1= ? AND mycolumn2= ?", demo_type_param, demo_tid_param).first