I've been looking though the source code and when you set an option it looks like no sanitization is done? I see serialization of arrays and everything else is cast to type string.

So theme and addon settings should be doing the sanitizing ahead of using pConfig()->set() or config()->set()? If so, is there already a Friendica method for doing that? I made a couple add-ons that have text fields on their settings pages and I wouldn't want anyone to be able to save malicious code into the database with them.