The title pretty much says it all.
If a callback is defined in a hook_menu, such as
function mymodule_menu ()
{
$items = array();
$items["mymodule/foo/%"] = array(
"page callback" => "mymodule_foo",
"page arguments" => array(2),
"access arguments" => array("mymodule permission"),
"type" => MENU_CALLBACK,
);
return $items;
}
function mymodule_foo ($parameter)
{
// do stuff
}
When the callback gets called, has $parameter
been sanitized, or is this the responsibility of the module?
I always sanitize in the module, but have never seen this stated either way and haven't found where callbacks get called from core.