I just started working on a project that will run on google app engine (GAE). I'm using java (wicket) with some ajax.

I'm experienced with relational databases and typically use something like iBatis. When going through the docs and examples for the GAE datastore using JDO I see that they're executing stuff like:

```
String query = "select from " + Employee.class.getName() + " where lastName == 'Smith'";
List<Employee> employees = (List<Employee>) pm.newQuery(query).execute();

```

Does anyone know if this JDOQL query is subject to security problems like SQL injection? If so, is there any way to remedy this?