Are params sanitized?

[ambrt]

Pardon an obvious question but i didn't find it the docs.

Say one has /@[user] folder and wants to display Astro.params.user in the frontmatter.
Does one have to sanitize it or is it sanitized by Astro already?

I'm aware of "never trust the client side" but if Astro is cleaning params then sanitizing them again would be a redundant work.