Question

Are all values escaped when using the ORM Module?

For example, if I have:

$user->where('username', 'LIKE', '%' . $this->request-post('user') . '%')->find_all()

Is this safe?

Answer 1

Yes, ORM uses the query builder, which automatically escapes all values.

Creating queries dynamically using objects and methods allows queries to
be written very quickly in an agnostic
way. Query building also adds
identifier (table and column name)
quoting, as well as value quoting.