Input sanitization for database interaction in zend framework

In commands like this in zend framework

$mapperObject->fetchAll($where, $order, $count, $offset);

Does one need to be careful about what the variables contain 开发者_C百科or ZF will take care of it for sql injection and all that?

Assuming this is using the standard Zend_Db_Table->fetchAll, then you are indeed protected from SQL injection as long as you use the secure methods for creating your parameters eg:

 $where = $select->where('id = ?', $id);
 // or ..
 $where = $select->where('id = :id');

and not

 $where = $select->where('id = $id');