I'm using Drupal 6 and having trouble with url_alias spam.

Somehow spam entries are showing up in the url_alias table as aliases for valid content.

I thought an administrator or valid user would have to create these. I don't understand how they're appearing for content that I created.

I appeared to have stopped spam registrations using a combination of Mollom, honey pot and spamicide. I can't figure out how the url_aliases are appearing.

Can anyone give me a good place to try to start figuring this out?

Thanks, Joe

  • 1
    Can you tell us exactly how one such spam entry in the url_alias table look like? Spam links are usually going to external pages, but a Drupal URL alias will always expand to an internal path. Doing what you say the spammers do, don't make sense from the perspective of the spammer. May 17, 2014 at 7:02

1 Answer 1


Who have access to Administer ➔ Site building ➔ URL aliases depends on how you've set access to the permissions administer url aliases and create url aliases under Administer ➔ User management ➔ Permissions. If you've granted access to the Anonymous user role, everybody can do it. If you've granted access to Authenticated user role, a rogue authenticated user can do it.

First, check out these permissions and make sure they are safe. Leave them unchecked for all roles. Then, only the super admin (user #1) can create aliases using the GUI.

If these setting are secure, and you still get unwanted url_alias entries created, then some outsider has gained direct access to your database. That's bad.

Finding the cause of database intrusion is not easy. Possible attack vectors are: A bad module that permits SQL injection, some means outside of Drupal (an inscure phpMyAdmin is the most common cause), or (in particular if you're on shared hosting) a host misconfiguration.

However, without having direct access to your site's and its log for forensics, it is impossible to know how an outsider has gotten into your database (if that is indeed the cause).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.