The problem is that the API pretends that it already sanitizes user input to a degree. (from the design perspective, not necessarily documentation) Sanitizing

The problem is that the API pretends that it already sanitizes user input to a degree. (from the design perspective, not necessarily documentation) Sanitizing the input yourself means not using it. You can't sanitize it.