Answers.Body: <p>First of all I would access the post using this format</p>
  
  <p><code>Craft::$app-&gt;getRequest()-&gt;post('username')</code> </p>
  
  <p>Craft then extends the YII 2 request object. Does it sanitise input, not really, but models can set validation rules like this </p>
  
  <p><a href="https://forum.yiiframework.com/t/how-does-yii-handle-data-sanitization/83006" rel="nofollow noreferrer">https://forum.yiiframework.com/t/how-does-yii-handle-data-sanitization/83006</a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-09-25T21:37:13.107Z
Answers.Text: Perfect, thank you.
Answers.UserDisplayName: Jessica Talzor
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-09-25T15:37:41.337Z
Answers.LastActivityDate: 2019-09-25T15:37:41.337Z
Answers.UserDisplayName: 32423hjh32423
Body: <p>Can I rely on Craft to clean user input, is safe to save the following data like in the below example function, if not, what is the Craft best practice for cleaning(making it safe) user input?</p>
  
  <pre><code>public function actionCustomSaveUser(){
  
      $user = new User();
      $user-&gt;newPassword = $_POST['password'];
      $user-&gt;username = $_POST['username'];
      // and more $_POST ...
  
      Craft::$app-&gt;getElements()-&gt;saveElement($user, false);
      // etc...
  
  }
  
  </code></pre>
  
Tags: <craft3><filter><controller>
Title: Does Craft automatically sanitize user input?
ThreadText: # Does Craft automatically sanitize user input?
  
  (Asked by: username_0 on 2019-09-25)
  
  Can I rely on Craft to clean user input, is safe to save the following data like in the below example function, if not, what is the Craft best practice for cleaning(making it safe) user input?
  
  ```
  public function actionCustomSaveUser(){
  
      $user = new User();
      $user->newPassword = $_POST['password'];
      $user->username = $_POST['username'];
      // and more $_POST ...
  
      Craft::$app->getElements()->saveElement($user, false);
      // etc...
  
  }
  
  ```
  
  **Tags:** craft3, filter, controller
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-09-25. Score: 1 | Accepted answer
  
  First of all I would access the post using this format
  
  `Craft::$app->getRequest()->post('username')`
  
  Craft then extends the YII 2 request object. Does it sanitise input, not really, but models can set validation rules like this
  
  <https://forum.yiiframework.com/t/how-does-yii-handle-data-sanitization/83006>
  
  > **Comments:**
  > **username_0**: Perfect, thank you.  
  
  ---
  
  