I made a custom module which is actually a bit extended contact form module. I'm saving form data into database.
Is it save just to call $model->save() with values from POST? This is how I save data:
$data = $this->getRequest()->getPost('partnercontact')
May I suppose that Magento sanitize values before saving it into database or my module is vulnerable to SQL injection attacks?