Skip to main content
Drupal Answers

Return to Question

deleted 4 characters in body; edited tags; edited title
Source Link
leymannx
leymannx
  • 18.8k
  • 6
  • 72
  • 126

Drupal 7 sanitization Sanitization of the q parameter

I'm using drupalDrupal 7. My My question regards the sanitization of the "q" parameter. We We know about sqlSQL injection, so I was wondering if this parameter mymay be a vector for this kind of security flaw. I've I've searched the drupalDrupal core files for the $_GET['q'] string. It It is used several times but I could't find any kind of sanitization. Perhaps Perhaps I've missed something.

My opinion is that Drupal does not uses the $_GET['q'] inside any kind of query or if it does it will be sanitized by the database apiAPI itself.

Drupal 7 sanitization of the q parameter

I'm using drupal 7. My question regards the sanitization of the "q" parameter. We know about sql injection, so I was wondering if this parameter my be a vector for this kind of security flaw. I've searched the drupal core files for the $_GET['q'] string. It is used several times but I could't find any kind of sanitization. Perhaps I've missed something.

My opinion is that Drupal does not uses the $_GET['q'] inside any kind of query or if it does it will be sanitized by the database api itself.

Sanitization of the q parameter

I'm using Drupal 7. My question regards the sanitization of the "q" parameter. We know about SQL injection, so I was wondering if this parameter may be a vector for this kind of security flaw. I've searched the Drupal core files for the $_GET['q'] string. It is used several times but I could't find any kind of sanitization. Perhaps I've missed something.

My opinion is that Drupal does not uses the $_GET['q'] inside any kind of query or if it does it will be sanitized by the database API itself.

Source Link
lastYorsh
lastYorsh
  • 201
  • 2
  • 4

Drupal 7 sanitization of the q parameter

I'm using drupal 7. My question regards the sanitization of the "q" parameter. We know about sql injection, so I was wondering if this parameter my be a vector for this kind of security flaw. I've searched the drupal core files for the $_GET['q'] string. It is used several times but I could't find any kind of sanitization. Perhaps I've missed something.

My opinion is that Drupal does not uses the $_GET['q'] inside any kind of query or if it does it will be sanitized by the database api itself.