Is Sequelize model.build (req.body) safe for injection?

Question

I am new to Sequelize (a node.js ORM) and am wondering if the following code is safe:

var models = require('../models');
var router = require('express').Router();

router.post('/', function(req, res, next){
  models.Account
    .create(req.body)       // <-- THIS IS WHAT MY QUESTION IS ABOUT, IS THIS SAFE?
    .then(function(result){
      res.status(200)
        .send(result)
        .end();
    }).catch(next);
});

If you use this, could it be unsafe? Another solution:

var models = require('../models');
var router = require('express').Router();

router.post('/', function(req, res, next){
  models.Account
    .create({
      username:    req.body.username, // <-- THIS IS MORE VERBOSE BUT PROBABLY SAFER?
      accountname: req.body.accountname,
      level:       req.body.level
    })
    .then(function(result){
      res.status(200)
        .send(result)
        .end();
    }).catch(next);
});

So, basically my question is: Is it safe to use the full body of the request as an input to the function model.create()(and model.set(), and model.build())?

Answer 1

, , , . , SQL Injection Attack, models.Account.create, ORM, , HTTP- ( , , )