<p>First of all I would access the post using this format</p>

<p><code>Craft::$app-&gt;getRequest()-&gt;post('username')</code> </p>

<p>Craft then extends the YII 2 request object. Does it sanitise input, not really, but models can set validation rules like this </p>

<p><a href="https://forum.yiiframework.com/t/how-does-yii-handle-data-sanitization/83006" rel="nofollow noreferrer">https://forum.yiiframework.com/t/how-does-yii-handle-data-sanitization/83006</a></p>

CC BY-SA 4.0
2019-09-25T21:37:13.107Z
Perfect, thank you.
Jessica Talzor
CC BY-SA 4.0
2019-09-25T15:37:41.337Z
2019-09-25T15:37:41.337Z
32423hjh32423
<p>Can I rely on Craft to clean user input, is safe to save the following data like in the below example function, if not, what is the Craft best practice for cleaning(making it safe) user input?</p>

<pre><code>public function actionCustomSaveUser(){

    $user = new User();
    $user-&gt;newPassword = $_POST['password'];
    $user-&gt;username = $_POST['username'];
    // and more $_POST ...

    Craft::$app-&gt;getElements()-&gt;saveElement($user, false);
    // etc...

}

</code></pre>

<craft3><filter><controller>
Does Craft automatically sanitize user input?
# Does Craft automatically sanitize user input?

(Asked by: username_0 on 2019-09-25)

Can I rely on Craft to clean user input, is safe to save the following data like in the below example function, if not, what is the Craft best practice for cleaning(making it safe) user input?
public function actionCustomSaveUser(){

    $user = new User();
    $user->newPassword = $_POST['password'];
    $user->username = $_POST['username'];
    // and more $_POST ...

    Craft::$app->getElements()->saveElement($user, false);
    // etc...

}

**Tags:** craft3, filter, controller


---

## 1 answers

### Answer by username_1 on 2019-09-25. Score: 1 | Accepted answer

First of all I would access the post using this format

`Craft::$app->getRequest()->post('username')`

Craft then extends the YII 2 request object. Does it sanitise input, not really, but models can set validation rules like this

<https://forum.yiiframework.com/t/how-does-yii-handle-data-sanitization/83006>

> **Comments:**
> **username_0**: Perfect, thank you.  

---

