2

The title pretty much says it all.

If a callback is defined in a hook_menu, such as

function mymodule_menu ()
{
    $items = array();

    $items["mymodule/foo/%"] = array(
        "page callback" => "mymodule_foo",
        "page arguments" => array(2),
        "access arguments" => array("mymodule permission"),
        "type" => MENU_CALLBACK,
    );

    return $items;
}

function mymodule_foo ($parameter)
{
    // do stuff
}

When the callback gets called, has $parameter been sanitized, or is this the responsibility of the module?

I always sanitize in the module, but have never seen this stated either way and haven't found where callbacks get called from core.

1 Answer 1

3

In D6

menu_execute_active_handler() calls the callback. However it gets it's arguments from menu_get_item(), which uses arg.

I can't see any sanitizing in any of that. So it looks like the answer is no.

In any case extra sanitizing can't hurt.

2
  • 1
    Thanks. This confirmed my suspicions, and also reminded me to try replacing space with underscores when searching core files for how something is implemented.
    – mpdonadio
    Aug 3, 2011 at 0:27
  • Extra sanitizing can hurt because double-escaped special characters can become hard to read. Feb 14, 2014 at 15:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.