Generally it's fine for most strings.  The rules that apply here are 1) sanitize any user input (e.g. page_id), and 2) most query APIs take in the parameters separately from the query string.  In other words, prefer ```GqlQuery("select * from t where fname = '%s' and lname = '%s'", "josh", "schwarz")``` to ```GqlQuery("select * from t where fname = '%s' and lname = '%s'" % ("josh", "schwarz"))```.  In other words, if you let the GQL library stitch together your query string and your arguments for you, it will automatically strip out dangerous characters from your arguments and protect you from SQL attacks.  Otherwise, you have to do it yourself.