Do I need to sanitize $userinput in this code, or is it done by Drupal?

$nids = \Drupal::entityQuery('node')
  ->condition('field_myfield', $userinput)

In my case, $userinput is a path parameter from the .routing.yml file.

If necessary, how do I sanitize it? I found RequestSanitizer::sanitize(). Is that enough to protect against SQL injections?

1 Answer 1


As shown in Writing secure code for Drupal / Use the database abstraction layer to avoid SQL injection attacks, it's not necessary to sanitize user input used in the condition() method, as long as the user input isn't used to select the operator to apply. This means that the code shown in the question is fine, but the following code is not.

  ->select('table', 't')
  ->condition('t.field', $value, $userInput)

What reported in that documentation is for the database classes, but it's also valid for the methods exposed from the instance returned by \Drupal::entityQuery().

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.