Kohana 3.1 ORM Security Question

Are all values escaped when using the ORM Module?

For example, if I have:

$user->where('username', 'LIKE', '%' . $this->request-post('user') . '%')->find_all()

Is this 开发者_如何学Gosafe?

Yes, ORM uses the query builder, which automatically escapes all values.

Creating queries dynamically using objects and methods allows queries to be written very quickly in an agnostic way. Query building also adds identifier (table and column name) quoting, as well as value quoting.