Do I need to sanitize
$userinput in this code, Or is it done by Drupal?
$nids = \Drupal::entityQuery('node') ->condition('type','my_node_type') ->condition('field_myfield', $userinput) ->execute();
In my case,
$userinput is a path parameter from the .routing.yml file.
If necessary, how do I sanitize it? I found
RequestSanitizer::sanitize(). Is that enough to protect against SQL injections?