Yes, WordPress will sanitise data on its way to the database, so long as you use the APIs.
If you're using the wpdb
object however you'll need to use the prepare
method to sanitise. I recommend against using the wpdb
object to write raw SQL as it bypasses object caches etc
For calls such as WP_Query, get_posts, add_post_meta etc etc sanitisation occurs
Note that this is purely DB sanitisation, any additional sanitisation or validation you require, such as trimming trailing spaces, validation URLs, stripping tags, escaping, must all be done in your code