0

I ran into an issue with usernames being trimmed in articles. I found a thread here with a fix suggesting to use $vars['name_raw']: https://www.drupal.org/node/854762#comment-7614255. It works.

But I'm wondering if $vars['name_raw'] should be sanitized with check_plain or not before being displayed to the screen. I'm not sure what the difference is between $vars['name'] and $vars['name_raw'] ? I searched and found no clear answer.

0

For this particular instance you should be fine because usernames already are filtered to a limited set of characters.

Like you assumed *_raw is unfiltered input. So in almost any other circumstance, it should be sanitized in some way before use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.