Untrusted data comes from imputs it needs to be validated both on input and output. WordPress transforms title to a permalink usig output sanitation function.
Slugs function:
sanitize_title( $title )
Specifically, HTML and PHP tags are stripped.
Usage
<?php sanitize_title( $title, $default_title ) ?>
Parameters
$title (string) (required) The string to be sanitized. Default: None
$default_title (string) (optional) A title to use if $title is empty. Default: ”
Examples Sanitize Titles
<?php
$slug_url = sanitize_title('WordPress Slug Function – for Permalink');
echo $slug_url;
?>
the output will be:
wordpress-slug-function—for-permalink
[ Short URL ... ]