flawopen.com/SQL Injection in PHP/Doctrine

Is Doctrine ORM safe from SQL injection?

Reference page — draft, pending review
Short answer

Yes for DQL (Doctrine Query Language) with bound parameters and the QueryBuilder. Building a DQL or native SQL string with interpolated values reintroduces the same risk as any other ORM's raw-query escape hatch.

UNSAFE
$em->createQuery(
  "SELECT u FROM User u "
  . "WHERE u.id = $userId"
);
SAFE
$qb->select('u')
  ->from('User', 'u')
  ->where('u.id = :id')
  ->setParameter('id', $userId);

The rule

setParameter() binds the value at the DQL layer, which Doctrine translates into a bound parameter in the underlying SQL — the value never becomes part of the query text. String-concatenating a value directly into a DQL string passed to createQuery() bypasses this entirely, and Doctrine's native SQL escape hatch (Connection::executeQuery()) carries the identical risk if built the same way.

How to check your codebase

grep -rn "createQuery(" --include="*.php" . | grep '\$\|+'

References