What security is Propel providing?

Question

Im using the Propel framework, for communication with a database. I figured that it's using PDO and makes a bindParam(), when I try to make an input, so SQL injections should be covered.

But does it provide extra seucurity such as strip_tags(), htmlspecialchars() or similar stuff, or should I do this manually?

I have used PDO before so I know the basics, but it's the first time im using Propel.

Answer 1

I would not expect an ORM to protect against XSS attacks. That is a problem that has nothing to do with the database layer (and would cause you problems if you wanted to store HTML).