Drupal 7 Module Development

Security
For output to the browser, check_markup() may be configured to escape HTML or
other content. The check_plain() function takes a somewhat more sledge-hammer
approach, escaping all HTML in a string so that it displays verbatim on the page for
the user to see.
SQL injection
For writing to the database, Drupal's database layer is built on the concept of
prepared statements. Prepared statements, among other things, cleanly separate
the SQL query from the variable data in it. That allows the database server itself to
sanely construct a query while escaping input itself, avoiding the common attack
known as "SQL injection". For example, a value that contains an apostrophe causes a
syntax error in an SQL statement (since single quotes have meaning in SQL) at best,
or allows an arbitrary extra SQL query to sneak into the command at worst.
To avoid that problem, never, ever put a variable into an SQL string directly. When
writing a query against Drupal's database, always ensure that the query portion is a
single string literal using placeholders and then provide values for the placeholders.
Doing so will allow the database to separate the query template from the variable
content and avoid SQL injection. If the query itself is variable, use the dynamic query
builder, db_select().
SQL injection from badly written queries is the most common, and
the most easily avoidable, form of security vulnerability.
Node access control
A particularly Drupal-specific security question is how to control access to nodes.
While Drupal's permission system handles the common use case of globally-readable
nodes and limited access to edit or delete nodes, there are plenty of cases where we
need more complex access control. Drupal's node access system handles those cases,
but it requires that we tie into it every time we look up nodes, that is, any time we
run a query that tries to find records in the node table.
Since there are so many varied situations where nodes could be used, such additional
access checks can only be done at the database level, that is, in the query itself.
Fortunately, Drupal allows modules to manipulate certain types of queries before
they are executed to add any sort of filtering. In order to allow Drupal to modify
our queries, we need to "tag" them appropriately.
[ 378 ]