title: Do I need to escape strings on Symfony2 with Doctrine queries?
body: <p>I've this code:<br>
  I get some data from a GET request:</p>
  
  <pre><code>$username = $request-&gt;get('username');
  </code></pre>
  
  <p>And then, I use doctrine to check if this username exists or not:</p>
  
  <pre><code>$found = $em-&gt;getRepository('Bundle:Users')-&gt;findByNick($username);
              if ($found){
                 //nickname in use
              } else {
                 //not found
              }
  </code></pre>
  
  <p>As you can see, I've no String escaping, so the value is directly sent to Doctrine. Is this a security issue? Should it be slashed for security reasons?<br>
  Note that I never use RAW queries, just prebuild ones from Doctrine.</p>