title: Is SQL injection protection built into SQLAlchemy's ORM or Core?
body: <p>I'm developing an <a href="https://aiohttp.readthedocs.io/en/stable/web.html" rel="noreferrer">aiohttp server</a> application, and I just saw that <a href="https://stackoverflow.com/a/32573490/5433896">apparently it isn't able to use SQLAlchemy's ORM layer</a>. So, I was wondering: if my application will only be able to use SQLAlchemy's core, is it still protected against SQL injection attacks?</p>
  
  <p>My code is the following:</p>
  
  <pre><code>async def add_sensor(db_engine, name):
      async with db_engine.acquire() as connection:
          query = model.Sensor.__table__.insert().values(name=name)
          await connection.execute(query)
  </code></pre>
  
  <p>A comment on the accepted answer in <a href="https://stackoverflow.com/questions/6501583/sqlalchemy-sql-injection">this related question</a> makes me doubt:</p>
  
  <blockquote>
    <p>you can still use execute() or other literal data that will NOT be
    escaped by SQLAlchemy.</p>
  </blockquote>
  
  <p>So, with the <code>execute()</code> used in my code, does the above quote mean that my code is unsafe? And in general: is protection against SQL Injection only possible with the SQLAlchemy ORM layer, as with the Core layer you'll end up launching <code>execute()</code>?</p>