I'm trying to use Drupal for a specific research purpose and it would be helpful if I could intentionally make a text box vulnerable to SQL injection. Specifically, it would be convenient if I can make the search box vulnerable but anything is better than nothing. How can I do this? As a point of clarification, I'm trying to do this from a browser, not the api or terminal. Thanks!

  • There should be no possible way to do this without changing code (that's kind of a big part of the database layer's responsibilities). If you somehow find a way, please keep it to yourself and report it to the security team ASAP, or it'll be Drupalgeddon all over again!
    – Clive
    Oct 21, 2015 at 23:04
  • @Clive changing code is alright as long as it's relatively straight forward. Based on nvahalik's answer that seems unlikely though
    – TCal
    Oct 21, 2015 at 23:34

1 Answer 1


So the only way to to do this would be to write a custom module and explicitly write bad code that would normally not pass community inspection.

I'll leave that as an exercise to the asker. ;)

Hint: Your module should also have a dependency on this module.

  • Hm, I don't have an issue writing some code but I'm a relative newcomer to Drupal. Is this something a novice can handle? Seems like writing a custom module is somewhat of an involved task
    – TCal
    Oct 21, 2015 at 23:38
  • There is far less of a learning curve with Drupal than there are with other frameworks. Check out the Drupal examples project for a ton of examples of how to build modules. You might even be able to modify something there to get what you want.
    – nvahalik
    Oct 21, 2015 at 23:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.