`replace_named_bind_variables` and `replace_bind_variables` are
definded in `sanitization.rb`, so it is reasonable these tests are
on `sanitize_test.rb`.