Is activerecord automatically sanitized for SQL Injection? Cant find a definitive answer.

[eluser]Mobotek[/eluser]
So I have been Googling to find an answer on this and I keep finding conflicting results. Some say you need to put in bindings some say you dont. So what I wam wondering is if something like this is sanitized for SQL Injection.

Code:

function getUser($user){

$q = $this->db->where('user',$user)->get('user_table');

       return $q->row();
}