I had to develop a Drupal 8 based website for a client. This client has a quite strict configuration for its firewall and filters the characters used in POST values. It happens to be a bit too restrictive on the contact form for the taste of the marketing department. The security team would consent to lift some character limitations if I could list them the measures used by Drupal and Webform to filter/sanitize user inputs.
I am pretty confident that Drupal does a good job in that regard. I expect a mixture of
filter_var(), custom functions calls and other related configurations but I couldn't find any details. All my searches on the subject spawns answers around the fact that Drupal does sanitize its input, but nothing concrete.
How does Drupal sanitize the user input?