[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-571618-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-571618-en":126},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","drupal-security-the-cheat-sheet-for-drupal-7x-golden-rules","Drupal Security - The Cheat Sheet - for Drupal 7.x - Golden rules","","Drupal Security: The Cheat Sheet (for Drupal 7.x) compiles practical guidance to reduce common web application risks in Drupal sites. It explains core golden rules about user input handling, then details major issue types including SQL injection, access bypass, stored/unfiltered XSS, and arbitrary PHP code execution. It provides safe coding patterns for database queries using placeholders, safe output escaping with check_plain, URL validation with check_url, and XSS filtering functions. It also covers safe usage of Drupal’s t() placeholder system and common pitfalls like enforcing access tags and server-side validation.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/presentations/","Presentations",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/drupal-security-the-cheat-sheet-for-drupal-7x-golden-rules/571618/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/drupal-security-the-cheat-sheet-for-drupal-7x-golden-rules/571618.png","ImageObject",442,249,{"name":42,"@type":43},"Anna Hans","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-23","2026-10-13",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",5,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What are the golden rules for handling user input in Drupal 7.x?","Question",{"text":63,"@type":64},"Input is treated as the root of the problem: Drupal stores exactly what users type. Responsibility to filter data before display is on you, since Drupal does not filter user input itself.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"How does the cheat sheet recommend preventing SQL injection?",{"text":68,"@type":64},"Use query placeholders and never insert variables directly into SQL strings. Always pass parameters separately to db_query (and related APIs) so the database layer applies safe placeholder handling.",{"name":70,"@type":61,"acceptedAnswer":71},"What functions are suggested for safely displaying user input and preventing XSS?",{"text":72,"@type":64},"Escape text with check_plain when outputting user-provided fields, use check_markup with appropriate filter rules when needed, validate URLs with check_url, and apply XSS filters such as filter_xss_admin for permissive admin-only cases.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},571618,1792036237,{"code":4,"msg":82,"data":83},"success",[84,88,93,98,103,108,113,118,122],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":86,"slug":87},11,90,"presentations",{"id":89,"doc_module":22,"doc_module_name":25,"category_name":90,"show_sort_weight":91,"slug":92},12,"Resumes",80,"resumes",{"id":94,"doc_module":22,"doc_module_name":25,"category_name":95,"show_sort_weight":96,"slug":97},14,"Invoices",70,"invoices",{"id":99,"doc_module":22,"doc_module_name":25,"category_name":100,"show_sort_weight":101,"slug":102},15,"Posters",60,"posters",{"id":104,"doc_module":22,"doc_module_name":25,"category_name":105,"show_sort_weight":106,"slug":107},16,"Social Media",50,"social-media",{"id":109,"doc_module":22,"doc_module_name":25,"category_name":110,"show_sort_weight":111,"slug":112},17,"Forms",40,"forms",{"id":114,"doc_module":22,"doc_module_name":25,"category_name":115,"show_sort_weight":116,"slug":117},18,"Letters",30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":55,"slug":121},21,"Paper Templates","papers-templates",{"id":123,"doc_module":22,"doc_module_name":25,"category_name":124,"show_sort_weight":4,"slug":125},158,"General","general-158",{"code":4,"msg":82,"data":127},{"doc_id":79,"user_id":128,"nickname":42,"user_avatar":129,"doc_module":22,"category_id":85,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":22,"language":135,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":136,"faqs":137,"seo_title":138,"seo_description":12,"update_tm":139,"read_time":4},5909892332657,"https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d","Drupal Security: The Cheat Sheet  \n(for Drupal 7.x)  \nGolden rules  \n- Input is the root of all evil.  \n-Drupal does not filter user input; it stores exactly what the user typed.  \n- It is your responsibility to filter user data when it is displayed.  \nTypes of security issues  \n-SQL injection: Allows the modification of SQL queries to bypass access control, destroy data, etc. Use db_query with proper place-holders.  \n-Access Bypass: Proper access checking is not performed; allows unauthorized users access to administrative functions by manipulating URLs, for example. Remember to use user_access, node_access, etc. appropriately  \n-Cross-Site Scripting (XSS) : Allows the injection of unfiltered HTML, including JavaScript that can be used to steal cookie data, intercept user input, etc. Properly filter user input with check_plain and friends.  \n-Arbitrary code execution: The most critical of all; PHP code can be directly embedded by a malicious user. Destruction is limited only by the user under whom PHP is running. Properly filter user input with check_plain and friends  \nWriting safe SQL queries  \nAlways use placeholders in queries and never insert variables directly.  \nBad  \ndb_query(“SELECT column FROM {table} WHERE string = '$string' and number = $number”);  \nGood  \ndb_query(“SELECT column FROM {table} WHERE title = :title and id = :id”, array(  \n':title' => $string,  \n':id' => $number ));  \nDisplaying user input check_plain ($text)  \nConvert special characters to plain text.  \nprint '\u003Cp>' . check_plain($node->title) . '\u003C/ p>';  \ncheck_markup($text, $format_id, $langcode, $cache) Run filters on a piece of text.  \nprint check_markup($user->signature);  \ncheck_url ($url)  \nStrip out harmful protocols in URLs.  \nprint '\u003Ca href=\"/' . check_url($url) . '\">';  \nfilter_xss_admin ($string)  \nVery permissive XSS/HTML filter for admin-only use.  \nprint filter_xss_admin($forum->description);  \nWorking with t() placeholders @example  \ntext is run through check_plain() .  \n$output = t('There are currently @count users online .', array('@count' =>$countvar));  \nOutputs: There are currently 9 users online  \n%example  \ntext is run through drupal_placeholder(), which in turn runs check_plain() .  \n$output = t('The user %name has just registered .', array('%name' => $user->name));  \nOutputs: The user \u003Cem>fred\u003C/em> has just registere  \n!example  \ntext is displayed as-is with no filtering; normally you should NOT use this unless output is being used for e-mail only. $output = t('View this full post at ! url'), array('!url' => '[http://](http://)[ ](http://)[www.example.com/](www.example.com/)');  \nOutputs: View this full post at [http://www.example.com/](http://www.example.com/)  \nResources  \nWriting secure code: [http://drupal.org/writing-secure-code](http://drupal.org/writing-secure-code)  \nXSS Cheat Sheet: [http://ha.ckers.org/xss.html](http://ha.ckers.org/xss.html)  \nSecurity announcements: [http://drupal.org/security](http://drupal.org/security)  \nOWASP Testing Project: [http://www.owasp.org/index.php/](http://www.owasp.org/index.php/)[ ](http://www.owasp.org/index.php/)OWASP_Testing_Project  \nCommon pitfalls  \nWhenever you are displaying content from a query toa user, use a dynamic query and tag it with the appropriate tag to make sure access checking is done.  \nBad  \n$result = db_query('SELECT title FROM {node} n WHERE . . . ');  \nGood  \n$query = db_select('node', 'n');$result = $query  \n->fields('n', array('title'))  \n->condition( . . . )  \n->addTag('node_access');  \nGuard session IDs as much as possible. Do not print them into a page or send them as part of an AJAX request.  \nNever rely only on client-side (JavaScript) validation; always have server-side code performing final checks.  \nNever pass in an array of input directly into a query. Let the database layer convert the array into placeholders for you:  \nBad  \ndb_query(\"SELECT t .s FROM {table} t WHERE  \nt .field IN (%s)\", implode(',', $user_array));  \nGood  \ndb_query('SELECT t .s","cbCaim8LPlxyzGM9","https://ap.wps.com/l/cbCaim8LPlxyzGM9","pdf",100083,"English","# Golden rules\n# Types of security issues\n## SQL injection\n## Access Bypass\n## Cross-Site Scripting (XSS)\n## Arbitrary code execution\n# Writing safe SQL queries\n# Displaying user input safely\n# Working with t() placeholders\n# Resources\n# Common pitfalls","[{\"question\":\"What are the golden rules for handling user input in Drupal 7.x?\",\"answer\":\"Input is treated as the root of the problem: Drupal stores exactly what users type. Responsibility to filter data before display is on you, since Drupal does not filter user input itself.\"},{\"question\":\"How does the cheat sheet recommend preventing SQL injection?\",\"answer\":\"Use query placeholders and never insert variables directly into SQL strings. Always pass parameters separately to db_query (and related APIs) so the database layer applies safe placeholder handling.\"},{\"question\":\"What functions are suggested for safely displaying user input and preventing XSS?\",\"answer\":\"Escape text with check_plain when outputting user-provided fields, use check_markup with appropriate filter rules when needed, validate URLs with check_url, and apply XSS filters such as filter_xss_admin for permissive admin-only cases.\"}]","Drupal Security - The Cheat Sheet - for Drupal 7.x - Golden rules | PDF",1791922746]