I'm new to Drupal and I am doing some module development for a Drupal 7 install. I've done development outside of Drupal and normally its best to always sanitize user input. I've seen different opinions of the matter but from what I have picked up is dont use form_state['input'] but what about form_state['storage'] or form_state['value']. I'm seeing some people say the API does the sanitizing and others say always sanitize. Can anyone explain to be best practice?


The values in $form_state['values'] are all sanitized.

The values in $form_state['input'] are the raw unsanitized form values.

$form_state['storage'] is usually only used on multistep forms to keep data for other form steps.

Where possible always use the values from $form_state['values'].

See this post for more information: Avoid using data from $form_state['input']

To quote that linked article:

The Form API's drupal_validate_form() and _form_validate() functions take care of populating a safe set of data in $form_state['values'], using sanitized data from $form_state['input'].

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.