title: Should I sanitize when using wp_signon() in WordPress?
body: <p>I'm using <code>wp_signon()</code> to authenticate a user:</p>
  
  <pre><code>$data = array();
  $data['user_login'] = $_POST['username'];
  $data['user_password'] = $_POST['password'];
  $data['rememberme'] = false;
  
  $user_login = wp_signon( $data, true );
  </code></pre>
  
  <p>As you can see, I've done nothing to sanitize the user's login and password. I was thinking of doing something like <code>sanitize_user( $_POST['username'] )</code> and then maybe something similar with the password but am unsure if this is necessary. </p>
  
  <p>Should I sanitize <code>$_POST['username']</code> and <code>$_POST['password']</code>? If so, I'd be grateful if you could explain why it is necessary in this use-case.</p>
  
  <p>Ref: <a href="http://codex.wordpress.org/Function_Reference/wp_signon" rel="nofollow">http://codex.wordpress.org/Function_Reference/wp_signon</a></p>