When I use WordPress built-in functions like

add_post_meta, update_post_meta, add_user_meta, update_user_meta

wp_insert_post, wp_insert_user

Should I do any escaping or sanitizing before passing the user-input data to these functions or these functions themselves do the trick?

here in codex Action_Reference/save_post the data is passed to update_post_meta right out of the $_POST.

wordpress security sql-injection
Edit
Report