How is user input sanitized?
Drupal uses Twig's autoescape feature, which in turn uses escape, which itself uses htmlspecialchars to prepare markup safe for output.

SafeMarkup::checkPlain() preceded the autoescaping (deprecated now), so you may see that used, and HTML::escape can be used if you need to do it manually for whatever reason.

As with all versions of Drupal, filtering is done on output only, not input, so filter_var and friends aren't involved.