One of the security principles is sanitize string and variables passed from client to server; SQL injection is one of the way to hack a website. in plain PHP there are some functions to prevent SQL injection:

What is Drupal 8 strategy to prevent SQL injection? How can I clean up client data post in my Controller to protect my site from SQL injection?

  • 3
    This'll wind up being closed as too broad in its current state, best practice around sanitising input is a larger topic then Q+A would deal with in one go. It'd be better to concentrate on a single area at a time and ask separate questions about each. For example, handling SQL injection and XSS prevention are completely different things, and wouldn't usually be talked about in the same breath
    – Clive
    Jul 14, 2016 at 8:20
  • @Clive you right, some I divide it in two question, SQL Injection and XSS, ok?
    – Yuseferi
    Jul 14, 2016 at 8:23
  • 1
    Sounds good to me
    – Clive
    Jul 14, 2016 at 8:27

1 Answer 1


Drupal 8 (like Drupal 7) uses PDO to communicate with databases.

With PDO, the DB API makes use of prepared statements, specifically to avoid SQL injection attacks.

Practically, this means that you should use the database API methods. If you use the select, update, delete methods directly, you have a better chance of avoiding SQL injection as everything will be parameterised.

If you use query, you need to be more careful, as the API can only protect you so much. For example, if you do this:

$sql = "SELECT uid FROM users WHERE name = '$_GET[name]'";

Then you deserve what you get :) You should always use this instead:

$sql = "SELECT uid FROM users WHERE name = :name";
\Drupal::database->query($sql, [':name' => $_GET['name']]);

Aside: In reality, you'll only see the 2 functions you mentioned being used in very old, practically obsolete code these days. The MySQL extension has been removed now, and stripslashes was traditionally used with magic quotes, which were deprecated in PHP 5.3. SQL injection is still very much a problem, but those 2 perhaps aren't the best to use for comparison in this day and age.

  • 2
    More good extra info here Drupal 8: Writing secure code
    – No Sssweat
    Jul 14, 2016 at 8:46
  • thanks alot, you mean if I want to use something like userAuth->authenticate($name,$pass);, it is not required I sanitize user and password for SQL injection danger before calling authenticate method?
    – Yuseferi
    Jul 14, 2016 at 8:50
  • 2
    No, you're a few levels up when you use methods like that, no need to think about SQL injection. There's always the outside chance that Drupal itself has a nasty vulnerability (think drupalgeddon), which would invalidate that statement, but in "peace times" as it were, you don't need to think about it
    – Clive
    Jul 14, 2016 at 8:52
  • 1
    @Clive as always good and comprehensive answer. thanks a lot.I learn from your answer :)
    – Yuseferi
    Jul 14, 2016 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.