I am working on a Drupal 7 site that uses a replacement pattern %1 inside a View header to generate a URL with the Organic Group id(og_group_ref).

The view header markup is

<a class="ct" href="/node/add/post?og_group_ref=%1">Create Convo</a>

Example URL of a page is site/b_posts/2, so the link created would be /node/add/post?og_group_ref=2.

This is vulnerable to XSS, since accessing the URL site/b_posts/%22%20onmouseover=%22alert%28559%29%22%20test=%22/2 would result in a JS alert getting executed on mousing over the link. How to protect against this? I used the latest version of Views and this is still happening.

  • 1
    Welsome to Drupal Answers. How do you create this link exactly?
    – berliner
    Commented Mar 6, 2014 at 23:12

1 Answer 1


You must enable validation on your contextual filter.

More information found here:



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.