Does expr()->literal() protect against SQL injection?

Question

symfony

They make a filter and have doubts about such a decision. Is SQL injection possible? If so, how to solve.

$orStatements = $this->queryBuilder->expr()->orX();
foreach ($result as $value) {
    $orStatements->add(
        $this->queryBuilder->expr()->like('table.column', $this->queryBuilder->expr()->literal('%' . $value . '%'))
    );
}
$this->queryBuilder->andWhere($orStatements);

Answer 1

https://www.doctrine-project.org/projects/doctrine...
You are NOT safe from SQL injection when using user input with:
Expression API of Doctrine\ORM\QueryBuilder
Concatenating user input into DQL SELECT, UPDATE or DELETE statements or Native SQL.