Is it necessary or good practice to sanitize url parameters or dynamic route id's when they are used in a fetch or for a server side db lookup?

Is there a module to help with url parameter sanitization or is is it best practice to just use regex to strip out all non alphanumeric chars?

Appreciate all help or input thanks in advance