ruby on rails does update_attributes protect against sql injection?

Question

Does update_attributes protect against sql injection?

Example:

 if @user.update_attributes(params[:user])
     # updated
 end 

I know find(), and {} and [] do in find :conditions, but didn't see any info on this method.