10

I want to disable the PHP Filter module on a large website, but going through all nodes, blocks and other fields where you could make possible use of the php filter would take eons.

Is there a simple way or method maybe by running SQL queries to find out where the php filter is used throughout my website?

Improve this question

4 Answers 4

Reset to default
9

Rather than re-inventing the wheel, just install the Security Review module, which has the following check:

PHP or Javascript in content (nodes and comments and fields in Drupal 7)

For blocks you can check the format column in the block_custom table.

The difficult one is Views - I've yet to find a reliable way to locate rogue PHP in Views programmatically.

Improve this answer
5
  • 1
    I guess if Security Review guys wasn't able to add a reliable check for Views, it may be simply next thing to impossible.
    – Mołot
    Apr 18, 2014 at 11:03
  • @Mołot : Just found a way to retrieve views which has php enabled please see my answer below.. It will be great to know it has any downsides or edge cases...
    – Anil Sagar
    Apr 18, 2014 at 12:02
  • 1
    All I got is "OK Untrusted users do not have access to use the PHP input format." - with latest version. It got me green when I had a block with php input format on front page. Your answer seems to be simply untrue at the moment.
    – Mołot
    Dec 2, 2014 at 23:30
  • So, from what I can tell... the Security Review Module tells you that the php filter is being used... not what elements exactly are using it, which in a true security review would be helpful. This is however a good warning that further investigation is needed.
    – General Redneck
    Dec 28, 2014 at 4:23
  • Related: Find which views are using Views PHP
    – mbomb007
    Feb 12, 2020 at 21:08
7

You can able to find all views which have php enabled by running below command in MySQL...

SELECT vv.name , vd.display_options
FROM views_display AS vd
LEFT JOIN views_view AS vv ON vv.vid = vd.vid
WHERE vd.display_options REGEXP '.s:[3]+:"php".*'

views_display table stores this information in serialized format.... I have tested above query works as expected.. Hope it helps to solve the views PHP riddle :-)

Improve this answer
4
  • 1
    Looks good. Would need to test it a bit. In the meantime I took liberty of editing and cleaned up the way you wrote the query (without touching it's logic, names etc of course).
    – Mołot
    Apr 18, 2014 at 12:05
  • Thank you :-) I just verified and i can able to see views which has php enabled.. Let's hope it works for OP too..
    – Anil Sagar
    Apr 18, 2014 at 12:08
  • 1
    This doesn't work for all views (e.g. those defined in code), and that regex could easily produce false positives...better than nothing though I guess :)
    – Clive ♦
    Apr 18, 2014 at 12:14
  • Using phpmyadmin you can very easily search across all columns of all tables, search for php and manually go through the results.
    – rooby
    Dec 14, 2015 at 9:09
1

Old question, but was first on my Google search.

There's a Contrib Module that is supposed to find all PHP entries:

PHP Finder

'PHP Finder' module is used to find where the PHP filter format is used, whether in the node, block or views.

Improve this answer
1
  • what about PHP used in Rules?
    – Pierre.Vriens
    Dec 1, 2017 at 20:34
0

The code from Anil Sagar above only works if the view is saved in the database. If the view is only in code it won't work. So, I wrote a little snippet that I run to save all the views to the db. Then I can use the MySQL snippet to surface php.

  $views = views_get_all_views();
  foreach ($views as $view) {
    if (empty($view->disabled)) {
      $view->save();
      drupal_set_message('view saved: ' . check_plain($view->name));
    }
  }
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.