sqlalchemy filters and sql injection

Question

I'm accepting a GET query parameter which will be used as piece of a search string.

If I have this:

x = request.args['x']
MyTable.query.filter(MyTable.myCol.ilike(x)).one()

Am I vulnerable to a SQL injection attack?

EDIT - I am using Postgres and SQLAlchemy 1.0 I think.

Answer 1

According to https://stackoverflow.com/a/31949750/3359014,

MyTable.query.filter(MyTable.myCol.ilike(x)).one() is not considered a raw sql and the underlying db-api will escape x.