Yes, all ORM's build their SQL using string concatenation, BUT the good ORM's won't use string concatenation on user data, instead they will use bind parameters.

This way the query sent to the server looks like this:

  SELECT * FROM whatever WHERE email = :1 AND user_name = :2;

And then the parameters are passed to the database server separately to bind to the above placeholders.

This way the database server knows what is user provided data and what is part of the SQL, and no special quoting is required since the database server handles that internally. It's much safer in that SQL injection becomes impossible at that point.