How to securise custom modules

Question

I'm trying to understand how to securise my custom modules to avoid php insert into custom inputs and SQL injections in my db_query.

For inputs I'm using :

$form['custom'] = array(
      '#type' => 'textfield',
      '#title' => t('Custom),
      '#description' => t('Custom'),
      '#default_value' => '',
)

I tried to insert some PHP in the input and it actually run it whereas in the documentation it saiys that using form API should escape PHP by using check_plain and the safe example given is :

$form['also_safe'] = array(
  '#type' => 'select',
  '#default_value' => 0, // FAPI will pass through check_plain(),
  '#options' => node_get_types('names'),  // FAPI will sanitize the '#options' attribute with check_plain() for select boxes.
);

So what am I doing wrong ?

Concerning my SQL query I can't succeed to use as documented :

$result = db_query('SELECT $ FROM {custom} WHERE uid= :uid", array(':uid' => $value['in_array'])).

When calling a non object value I just get an error, so doing something like that works well but doesn't escape SQL injection :

$to_user_balance = db_query("SELECT * FROM {ubercart_funds_user_funds} WHERE uid=" . $value['in_array']));

I have to precise that I'm actually learning PHP and still didn't get what objects are. Because my aim is result and not capability, if somebody can explain me quickly how to securise my queries and inputs or drive me to a clear documentation.

I already know those documentation page and didn't help :

• Handle user input with care
• db_query

Answer 1

It's a better idea to use db_select or other DB API functions, rather than trying to use db_query directly. You'd want to try something like:

 $to_user_balance = db_select('ubercart_funds_user_funds', 'ucfuf')
   ->fields('ucfuf')
   ->condition("uid", $value['in_array'], '=')
   ->execute()
   ->fetchAssoc();

For more, see https://api.drupal.org/api/drupal/includes%21database%21database.inc/function/db_select/7.x

And for overall DB API docs, see: Drupal.org DB API docs