Does Craft automatically sanitize user input?
First of all I would access the post using this format

Craft::$app-&gt;getRequest()-&gt;post('username') 

Craft then extends the YII 2 request object. Does it sanitise input, not really, but models can set validation rules like this 

https://forum.yiiframework.com/t/how-does-yii-handle-data-sanitization/83006