It depends. If you take arguments to some sub-system (an example are database keys like the id of an entity instance), then you need to sanitize input. Anyway

It depends. If you take arguments to some sub-system (an example are database keys like the id of an entity instance), then you need to sanitize input. Anyway, today I learnt something. If you have free-form data like text it makes sense not to sanitize it because in this case sanitizing depends on the output domain. For example < is dangerous for HTML and ' is dangerous for SQL, and so on.