I had to develop a Drupal 8 based website for a client. This client has a quite strict configuration for its firewall and filters the characters used in POST values. It happens to be a bit too restrictive on the contact form for the taste of the marketing department. The security team would consent to lift some character limitations if I could list them the measures used by Drupal and Webform to filter/sanitize user inputs.

I am pretty confident that Drupal does a good job in that regard. I expect a mixture of htmlentities(), filter_var(), custom functions calls and other related configurations but I couldn't find any details. All my searches on the subject spawns answers around the fact that Drupal does sanitize its input, but nothing concrete.

How does Drupal sanitize the user input?

  • The key thing to note, which Clive mentioned below, is that input is saved as-is, and is only filtered for output.
    – Jaypan
    Commented Jun 26, 2018 at 22:22

1 Answer 1


Drupal uses Twig's autoescape feature, which in turn uses escape, which itself uses htmlspecialchars to prepare markup safe for output.

SafeMarkup::checkPlain() preceded the autoescaping (deprecated now), so you may see that used, and HTML::escape can be used if you need to do it manually for whatever reason.

As with all versions of Drupal, filtering is done on output only, not input, so filter_var and friends aren't involved.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.