title: If I receive post data with Flask, put that data into a WTForms form and it successfully validates, is it safe from SQL injection attacks?
body: <p>I am using Flask, WTForms, and the OurSQL MySQL library for my app.  I receive post data from the <code>request.form</code> variable.  I put that into a WTForms form object.  I call <code>validate()</code> on that form, and then insert the form data into a MySQL database using OurSQL.</p>
  
  <p>Without doing any additional processing, am I safe from SQL injection?  Does the WTForms <code>validate</code> method do escaping?  If not, what should I do to escape the data?  An example of what I am doing looks like this:</p>
  
  <pre><code>form = MyWTFFormsForm(request.form)
  if form.validate():
      cursor.execute("INSERT INTO mytable VALUES (?, ?, ?, ?, ?);",
              (form.field1.data, form.field2.data, form.field3.data,
               form.field4.data,
               form.field5.data))
  </code></pre>