TP5: I used the INPUT function to receive parameters, do I need to filter SQL injection again?

TP5: The INPUT function is used to receive parameters. Do I need to filter SQL injection? What actions does the default INPUT function do?

With PDO parameter binding, you basically don't need to consider the problem of sql injection (unless you splicing SQL yourself), you need to consider XSS filtering, which requires setting a global filtering method (the default input method is also based on global filtering parameters. ), the global filter method is not set by default