How to use API chaining to create a contact and a relationship
I believe it would be '$value.id' (ex. https://github.com/civicrm/civicrm-core/blob/master/api/v3/examples/Contact/APIChainedArrayValuesFromSiblingFunction.php). Basically, '$value' can be used to reference any values added by the parent api call.

Also, to your question about sanitization, the values should be sanitized. However, I would recommend using CRM_Utils_Request::retrieve() to get the submitted values from the request rather than $_POST as it does some extra sanitization work.