App Engine uses GQL which is effectively the same as SQL: http://code.google.com/appengine/docs/python/datastore/gqlreference.html http://code.google.com/appeng

App Engine uses GQL which is effectively the same as SQL: http://code.google.com/appengine/docs/python/datastore/gqlreference.html http://code.google.com/appengine/docs/python/datastore/gqlre... You can still directly append unescaped user input to your query and execute that against your datastore, though the limited capabilities of GQL does limit the attack surface somewhat.