[TYPO3-english] Re: how to: properly escape strings in 4.5.30?

[Calgacus map Brude]

or am I worried over nothing?  is typo3/extbase suseptible to sql injection attacks when using the default update and add methods?  If it uses string concat to piece together sql then it may be but if it uses prepared statement it isn't.  I come from a place that still used alot of string concat sql so this worry is just second nature to me.