That depends on how you work with your forms.
Bolt uses twig, and twig has some builtin stuff to cleanup the input, like {{ var|escape }}
. http://twig.sensiolabs.org/
You can build an extension that provides the forms, and in that extension you can use all of the validation methods in the symfony form components or whatever you throw at it in php before you store the form values. But you need to configure it all yourself.
If you use the simpleforms extension most of that will be done for you. In that case some filtering is done on the form input, but what happens with it will be up to you again.
If you just create some plain forms in HTML and add those to your template or content there is no filtering, and you need to do that (serverside) in the script that handles the form.