Reading through Drupal 6 docs, it appears that db_query and db_query_range take the entire query.

This is different from Drupal 7, which can separately take user input as an argument, effectively sanitizing it.

What is the proper way to deal with custom queries, that contain unsafe input in Drupal 6?


The Drupal 6 version of db_query supports placeholders. The best explantion of these is probably the Writing secure code article.

A (contrived) example would be

$query = "
  SELECT node.nid FROM {node} node
  INNER JOIN {content_type_foo} content_type_foo ON content_type_foo.nid = node.nid
  WHERE content_type_foo.field_foo_value = '%s'

$foo = $_GET["foo"];    
$nid = db_result(db_query($query, $foo));

The referenced article also shows how to use placeholder arrays for handling a variable number of arguments, like for WHERE IN queries.

The second edition of Pro Drupal Development, which covers Drupal 6, is also a good reference for using the database abstraction later.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.