Q:

security in symfony2 's post value

i have text box in my website. this text box give text value with form and post method.
this form search special text in database.
How can I be certain of the safety input data from sql injectin or xss.

A:

Because of the nature of the ORM database style in Symfony2 you are naturally protected from SQL injection. Data that does not match the constraints set by your configuration or Validator class will be rejected before reaching the database anyways.
Data is automatically encoded before being passed into the Request Class. XSS is not possible because on both the receiving side and the outputting side the data is not in its RAW form unless you specify it to be, in which case you would negate the built in security anyways.
XSS in forms is not feasible because Symfony by default (when using the Form Class) will create CSRF tokens in your form submissions to validate the sender of the request. Unless you specifically disable them, they will generate automagically and be included in a hidden field.
The built in functionality of symfony is only a first step, the best practice is to use Data Transformers to ensure your data is of the format and type you expect it to be.
Data Transformers: http://symfony.com/doc/current/cookbook/form/data_transformers.html
Finally, on the note of SQL Injection, using the built-in Query builder or using the DQL language (if your using doctrine) is another layer of security to prevent injections when using highly customized queries.

