zend framework sanitizing data

Question

I've seen different comments all over the place, some say that zend framework automatically sanitizes post/get data but others say it doesn't.

What's the deal? I've seen that doing it in the predispatch with a foreach on getParams is the quickest way, but does anyone have any suggestions?

Answer 1

Probably the deal is about Zend_Controller_Request vs the Zend_Db. Request data are often put into the DB.

Request object does not escape anything. You may force it to do using filters, form filters or e.g. using the reflection technique described here:

• Actions, now with parameters!

Zend_Db queries are basically escaped like in other ORM's, like in PDO.