Is there any other way to create more secure link in a drupal_set_message??

$loglink = l("bla bla", 'admin/config/services/blabla');
  drupal_set_message(t("You should not have empty or the default fields in $loglink. You have to fill your own information."), 'error');
  • 1
    What do you mean by "secure" in this context?
    – Clive
    May 14, 2015 at 8:23
  • I mean more security options exept that above
    – Karmen
    May 14, 2015 at 8:26
  • 1
    What "security options" are above? Are you sure you mean "security"?
    – Clive
    May 14, 2015 at 8:32
  • Maybe from the other end: why do you think links as they are now are not secure enough? If we don't know what you think is wrong, we can't tell how to make it better.
    – Mołot
    May 14, 2015 at 8:52
  • Running your link through t() opens it to be altered by anybody with translation permissions. It's probably not your intent so you should translate strings and have the link be a variable passed to t().
    – Ben
    May 14, 2015 at 10:17

1 Answer 1


No, there isn't a more secure way, especially when you are not outputting input coming from the user. Still, you should be using t()-placeholders.

Drupal core uses the following code, when outputting an URL.

// system_requirements()
$requirements ['php'] = array(
  'title' => $t('PHP'),
  'value' => $phpversion,
  'description' => $t('The phpinfo() function has been disabled for security reasons. To see your server\'s phpinfo() information, change your PHP settings or contact your server administrator. For more information, <a href="@phpinfo">Enabling and disabling phpinfo()</a> handbook page.', array('@phpinfo' => 'http://drupal.org/node/243993')),
  'severity' => REQUIREMENT_INFO,
  // action_synchronize()
  $link = l(t('Remove orphaned actions'), 'admin/config/system/actions/orphan');
  $count = count($actions_in_db);
  $orphans = implode(', ', $orphaned);
  watchdog('actions', '@count orphaned actions (%orphans) exist in the actions table. !link', array('@count' => $count, '%orphans' => $orphans, '!link' => $link), WATCHDOG_INFO);

The only difference is that, in the first case, the code is outputting an external URL while, in the other case, the URL is internal to the website.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.