Ecto.Adapters.SQL.query for sql query leads to sql injection attack?

Depends in how you build the query. If you’re using a static query, with parameters passed separately then you’re fine. If you’re dynamically building the query itself based on user input you’re opening routes for sql injection.