Drupal 7 Module Development

Security
Throughout this book, we have repeatedly discussed the question of security.
What makes good security practice? How do we make code more secure? How do
we protect against common attacks? That's because security is not a feature to be
bolted into a program. It is part and parcel of the development process itself.
Nonetheless, because it is such an important subject this appendix will give an
overview of the tools Drupal offers to help make code more secure, and the sorts
of things to think about when writing code to ensure that our code is as secure as
possible. It is by no means exhaustive; many books have been written exclusively on
the subject of security. However, it should lay a strong foundation for approaching
code writing in a secure fashion.
Thinking securely
Security is a process. Specifically, it is a development process. The most important
aspect of security is how we approach the code that we are going to write. We need
to "think securely" in order to write robust code. Although there are many aspects
to thinking securely, it can be summed up as "think paranoid".
The vast majority of input into our system is going to be sane and what we expect,
not dangerous. However, there will always be that last 1% that is not at all what we
expect. It could be someone deliberately trying to break into our website. It could be
a spambot trying to find vulnerabilities so that it can turn our site into a billboard for
fake proscription drugs. Alternatively, it could just be an honest user who entered
input that we didn't anticipate and account for. All of these things will happen
at some point during the life of a website or web application, and the best way to
protect against them is to assume that any input is a suspected attack until we can
verify otherwise.