I noticed a problem using webtools as reported here:

https://forum.phalcon.io/discussion/20775/bug-in-scaffold-generated-controller-all-fields-are-taken-from-p

I debugged the problem and seems that i spotted a bug more generalized:

1) The code to generate the fields for sanitizing seems to not be complete and checks only for int and emails, in function captureFilterInput defined in vendor/phalcon/devtools/src/Builder/Component/Scaffold.php but this would not be so much an issue if wasn't presente the problem number 2

    private function captureFilterInput(string $var, $fields, bool $useGetSetters, string $identityField = null): string
    {
        $code = '';
        foreach ($fields as $field => $dataType) {
            if ($identityField !== null && $field == $identityField) {
                continue;
            }

            if (is_int($dataType) !== false) {
                $fieldCode = '$this->request->getPost("'.$field.'", "int")';
            } else {
                if ($field == 'email') {
                    $fieldCode = '$this->request->getPost("'.$field.'", "email")';
                } else {
                    $fieldCode = '$this->request->getPost("'.$field.'")';
                }
            }

2) Metadata are acquired/stored wrongly, leading to wrong contoller scaffold generation

I run the following i took from the docs (just changed the class from Robots with Company):

$robot = new Company();

// Get Phalcon\Mvc\Model\Metadata instance
$metadata = $robot->getModelsMetaData();

// Get robots fields names
$attributes = $metadata->getAttributes($robot);
print_r($attributes);

// Get robots fields data types
$dataTypes = $metadata->getDataTypes($robot);
var_dump($dataTypes);
        $this->view->disable();

This is the output:

Array
(
    [0] => id
    [1] => legal_name
    [2] => legal_address
    [3] => registration_number
    [4] => state
    [5] => account_owner_userid
)
array(6) {
  ["id"]=>
  int(14)
  ["legal_name"]=>
  int(2)
  ["legal_address"]=>
  int(14)
  ["registration_number"]=>
  int(2)
  ["state"]=>
  int(2)
  ["account_owner_userid"]=>
  int(14)
}

int(2) should be type string, as reported in the comments of the corresponding model:

    /**
     *
     * @var integer
     */
    protected $id;

    /**
     *
     * @var string
     */
    protected $legal_name;

    /**
     *
     * @var integer
     */
    protected $legal_address;

    /**
     *
     * @var string
     */
    protected $registration_number;

    /**
     *
     * @var string
     */
    protected $state;

    /**
     *
     * @var integer
     */
    protected $account_owner_userid;

The generated model (not controller) uses a different strategy using describeColumns onthe go in the function getPHPType defined in vendor/phalcon/devtools/src/Builder/Component/Model.php