I'm using D7 Form API to make some custom forms for users that create nodes on submit (using node_submit & node_save functions). This is an example form I'm using:

function create_article_form($form, &$form_state) {

$form['node_title'] = array(
    '#type' => 'textfield',
    '#title' => t('Node Title'),
    '#size' => 20,
    '#required' => TRUE,

$form['submit_button'] = array(
   '#type' => 'submit',
   '#value' => t('Create Node'),

return $form;

This works great, but I'm just wondering about sanitization. From my research it seems like the check_plain() function should be used for text fields for security. However, it also causes raw HTML entities to be saved.

For example, I am setting the node title in the submit function like this:

$node->title = check_plain($form_state['values']['node_title']);

This problem is, if the user enters something like this:

Mike's Tacos

it gets saved in the node title like this:

Mike's Tacos

So if I output that title anywhere (in a view, in a custom node--XX.tlp.php, etc, it shows in this way.

Can anyone help with how to still use check_plain (or whatever function will provide the best security) but have the value saved with the human-readable format (Mike's Tacos)?


1 Answer 1


Filters are used for output, not input. It's the Drupal way; save the raw, un-sanitised data in storage, and filter (and cache) when it's being rendered.

You shouldn't run check_plain() on your node title before saving it, as it will be run through the same function by core/contrib when the node is being rendered, hence the double-encoding you're probably seeing.

If you're responsible for rendering the node title yourself at any point, you should always run it through check_plain() first:

echo check_plain($node->title);

But always on output, never on input.

  • I see. Thanks for clearing that up for me, Clive! Marked as answer.
    – Micah Boon
    Oct 2, 2014 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.