I've been looking though the source code and when you set an option it looks like no sanitization is done? I see serialization of arrays and everything else is cast to type string.
So theme and addo...
@Random Penguin Code is only malicious when it's retrieved and displayed. This is why all template variables are escaped by default. This way even malicious HTML/Javascript entered into config files will be displayed as is in a template variable interpolation.
Malicious code is harmless in the database itself. Malicious code that would targets the database like SQL injection is handled separately by using bound variables during requests, so no user-supplied values (or any other, for that matter) is ever treated as part of the query itself.
Sanitization is a neverending whack-a-mole game while blanket escaping and SQL bound variables are once and done solutions.
Malicious code is harmless in the database itself. Malicious code that would targets the database like SQL injection is handled separately by using bound variables during requests, so no user-supplied values (or any other, for that matter) is ever treated as part of the query itself.
Sanitization is a neverending whack-a-mole game while blanket escaping and SQL bound variables are once and done solutions.
1