I am using Drupal 7. I have a page that has a PHP body that I know does not have any dangerous tags. According to the README.txt file in Security Review I need to add this to the "security_review_known_risky_fields" system variable ? Can somebody provide an example on how to do this? I am not sure exactly what the entry in the variable table should look like.


2 Answers 2


In settings.php add the following:

$conf['security_review_known_risky_fields'] = implode(

...where 'xxx', 'yyy', and 'zzz' are the content hash strings shown for each problematic file in the Security Review report.

  • Does some of my answer need to be combined with this one?
    – cilefen
    Jan 11, 2023 at 21:10
  • Would be good if an example of this gets added to the module's README.
    – leymannx
    Jan 12, 2023 at 6:14

The README says to create "a SHA-256 hash of the entity_id, entity_type, and field contents". It looks like you have to call hash('sha256', $entity_id.$entity_type.$field_contents) and save that in the security_review_known_risky_fields string variable, which can be done in settings.php. If there are multiple fields you want to allow, separate their respective hashes with commas.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.