We have webforms for authenticated users (anyone can create an account without admin approval) to fill out. With their submission data I'm using the civicrm_api to create contacts and relationships.

For example:

// in hook_webform_submission_insert I do this:
$newcontact= civicrm_api3('Contact', 'create', array(
  'sequential' => 1,
  'contact_type' => 'Organization',
  'contact_sub_type' => 'Sub_Type',
  'organization_name' => $submission->data[20][0],

Is there any filtering I should be doing or are Drupal's security measures sufficient?

There are various hooks I could use. Currently I'm using a combination of hook_form_alter with submit callbacks and hook_webform_submission_insert. Would one of these or some other hook have significantly greater security measures?


Designers need to worry about two things, making sure that user-supplied data can go into the database successfully, and also that data pulled from the database can be written to the page successfully.

When adding data to the database, Drupal will use prepared statements to ensure the SQL injection does not occur. What this means is, Drupal will tell the database, "Expect to see an INSERT command that looks like {statement}." and then sends all the data. If the resulting statements does not match, there will be an error.

Drupal Fields are defined such that the system knows how the data in that field should be displayed. The database schema guarantees that only a certain data format is available. For example, if the field is a number, we know we won't get a string because the database is designed to only record numbers. Drupal can just worry about formatting it properly. Same if it's text, it will make sure that it is not displaying a URL by passing the text through check_plain() after retrieving the data from the database.

In your case, you are going to be inserting this user-supplied data into the database. The Drupal Field API should be ensuring that the data is of the correct type for the database, and that it is not too long, or improperly formatted before inserting the record. It will insert it using the prepared statement to prevent SQL injection. So, you should be fine.

Make sure you read the CiviCRM secure coding guide: https://docs.civicrm.org/dev/en/latest/security/

  • I accidentally described this wrong... I'm not using Drupal "entities" but CiviCRM contacts ...so it's not actually using the field_api. But would the CiviCRM api likewise ensure the data is proper for saving to db? In addition to the link you gave I'm also looking at docs.civicrm.org/dev/en/latest/security/inputs but still not sure of how my api calls fit into that...? Maybe I should create a new question in the Civi forum. Sorry for the confusion :/ – alec Feb 7 '18 at 15:19
  • I was assuming the API you are using was piggybacking on the Drupal API. If it doesn’t, I have no idea what it does or does not do. Sorry. – Kevin Nowaczyk Feb 7 '18 at 15:32
  • Thanks for your help! Now I can simply ask about civicrm_api3() in the Civi forum. – alec Feb 8 '18 at 0:58
  • you said "Designers need to worry about two things" ...I assume you mean "developers"..? – alec Feb 8 '18 at 0:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.