is it safe to use $this->db->query($sql);

The code you have shown is only save if you were to use

Code:

$this->db->escape()

on each variable prior to calling the query() method.

And gadelat is right - use query bindings because it does it for you.

Support Development •  CodeIgniter 4 Foundations • Practical CodeIgniter 3  • CodeIgniter Tutorials