What everyone is missing with the filtering argument is: (1) normalization (things like trim, etc. so you don't do stupid things like invalidate an email addre

What everyone is missing with the filtering argument is: (1) normalization (things like trim, etc. so you don't do stupid things like invalidate an email address just because it was input with trailing spaces). The result is passed to a validator. (2) validation (if a number is expected, it's only valid if given a sequence of digits within the correct range). Valid values are passed on to the next phase (likely persisted). Sanitization is generally not needed and in most cases likely to cause data corruption. I'm sure there are use cases for it but it should be the exception, not the rule.