title: Does Scala Anorm String Replacement Sanitize Inputs?
body: <p>I am using the Play! framework along with Anorm to access the database. I often see examples like the following where object members are injected into the SQL statement directly.</p>
  
  <p>My question is, are these inputs sanitized? Most examples look like the following:</p>
  
  <pre><code>object Person {
      def save(p:Person) {
          DB.withConnection ("default") { implicit connection =&gt;
              SQL("""
                   INSERT INTO person(firstName,lastName)
                   values ({firstName}, {lastName})
                  """
                 ).on(
                  "firstName" -&gt; p.firstName,
                  "lastName"  -&gt; p.lastName
              ).executeUpdate()
          }
      }
  }
  </code></pre>
  
  <p>I will attempt to find out by way of hacking, but it's easy to make a mistake so I thought asking was more appropriate, and I can draw on the wisdom of the crowd.</p>