How is user input sanitized?

Question

I had to develop a Drupal 8 based website for a client. This client has a quite strict configuration for its firewall and filters the characters used in POST values. It happens to be a bit too restrictive on the contact form for the taste of the marketing department. The security team would consent to lift some character limitations if I could list them the measures used by Drupal and Webform to filter/sanitize user inputs.

I am pretty confident that Drupal does a good job in that regard. I expect a mixture of htmlentities(), filter_var(), custom functions calls and other related configurations but I couldn't find any details. All my searches on the subject spawns answers around the fact that Drupal does sanitize its input, but nothing concrete.

How does Drupal sanitize the user input?

Answer 1

Drupal uses Twig's autoescape feature, which in turn uses escape, which itself uses htmlspecialchars to prepare markup safe for output.

SafeMarkup::checkPlain() preceded the autoescaping (deprecated now), so you may see that used, and HTML::escape can be used if you need to do it manually for whatever reason.

As with all versions of Drupal, filtering is done on output only, not input, so filter_var and friends aren't involved.