what kind of sanitization needs to be done when doing civicrm_api3('Contact', 'create') inside custom drupal modules?

Question

How does creating contacts via civicrm_api3() fit into these areas https://docs.civicrm.org/dev/en/latest/security/#strategy https://docs.civicrm.org/dev/en/latest/security/inputs ?

If I'm using this inside custom drupal modules, is it safe to simply:

function mycustom_webform_submission_insert($node, $submission) {
  if ($node->nid == 123) {
    civicrm_api3('Contact', 'create', array(
      'sequential' => 1,
      'contact_type' => 'Organization',
      'contact_sub_type' => 'Sub Type Name',
      'organization_name' => $submission->data[48][0],
      // I've done nothing to that $submission data, it's only been processed by whatever Drupal/Webform module do.
      // Is that a security risk?
    ));
  }
}

Answer 1

The Drupal Webform module sanitises form inputs.

The Webform CiviCRM Integration module uses the underlying webform submission functions to sanitise data.

However the accepted answer on this question makes a very valid point.

It's a common misconception that user input can be filtered. PHP even has a >(now deprecated) "feature", called magic-quotes, that builds on this idea. It's nonsense. Forget about filtering (Or cleaning, or whatever people call it). What you should do, to avoid problems, is quite simple: whenever you embed a string within foreign code, you must escape it, according to the rules of that language.

Both modules mentioned above are covered by the Drupal security advisory policy.