No, you do not have to.
Not at all. var may contain format specifiers, which poses a
certain security issue into people's hands. This is already
important in userspace, so is probably even more in the kernel,
even though user-supplied strings are less common.
-