title: SQL Escaping/Sanitizing Magento Item Attribute Value Data That Is Set Programmatically?
body: <p>When I programmatically set a Magento item attribute to data that the user provided, do I need to SQL escape/sanitize that data or does Magento take care of doing so?</p>
  
  <p>--
  Here's a code example:</p>
  
  <pre><code>$cart = Mage::getSingleton('checkout/cart');
  $cart-&gt;addProduct($product, array('qty' =&gt; 1, 'options' =&gt; array(5 =&gt;$rawDataFromPost)));
  $cart-&gt;save();
  </code></pre>