Can I rely on Craft to clean user input, is safe to save the following data like in the below example function, if not, what is the Craft best practice for cleaning(making it safe) user input?

public function actionCustomSaveUser(){

    $user = new User();
    $user->newPassword = $_POST['password'];
    $user->username = $_POST['username'];
    // and more $_POST ...

    Craft::$app->getElements()->saveElement($user, false);
    // etc...



First of all I would access the post using this format


Craft then extends the YII 2 request object. Does it sanitise input, not really, but models can set validation rules like this



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.