How do I go about putting standalone PHP files?

Question

I want to add an extra cool PHP Class, where would I put it in Drupal, how do I make absolutely sure the code doesn't present a security risk, should I just make it into a module?

Answer 1

Your best bet would be to include it via a custom module, and to include it would be as easy as using module_load_include().

As for security, I would advise taking a look at the Drupal coding standards documentation, which is unfortunately tagged as D7 and I wasn't able to find the old D6 version, but generally following standards will help prevent some security issues.

Code not written exclusively for Drupal may not specifically work out of the box either, you may have to write a bridge for the code to integrate it better, otherwise you may need to re-write it completely.

Answer 2

There are two questions being asked, here:

• Should I make the PHP class a module?
• How can I be sure it doesn't contain security issues?

If you are distributing your own PHP class, or you are providing the class to your own customers, making the class part of a module is what I would do it. If the class is part of a module, then it's easier for third-party modules (or even for another module that you developed as part of the custom code you provide to a client) to verify if the class is available; it also make possible to avoid other modules use that PHP class without the need to delete the file, if the other modules check if the module is available instead of checking if the class is available (which means to use module_exists()).
With Drupal 7 is even easier create an object of a class defined from third-party modules; the module doesn't even need to first load the file containing the class, if the module containing such file lists it in the .info file, using the directive files[]: that operation is automatically done from Drupal, through the registry it implements.

Putting code into a module doesn't automatically make it secure; to create secure code you need to follow what reported in Writing secure code. Following the Drupal coding standards allows you to code that can be easier understood from other users (which means they can easier find security issues or other problems present in your code), or code that doesn't create conflicts with the existing modules; the coding standards don't report how to write secure code, except in some particular spots, like when they suggest how to avoid SQL injections.

To notice that the coding standards have not been updated for Drupal 7; in fact, the part about using SQL placeholders is still referring to Drupal 6 code.

Answer 3

Yes, you can do that easily by creating a custom module and then place the class inside that. You likely need some glue code anyway to connect the functionality of that class with Drupal, for example with hooks.

You do have to be aware of a few things:

• Drupal is GPL. All code that is called directly by Drupal (in contrast to an XML-RPC or REST Service) must be GPL or GPL compatible. If you keep that class for yourself, it's not that big of a problem (Still a license vioalation but nobody can verify it ;)) but if you want to distribute it, then it gets important.

• If you plan to release that module on d.o, you must not include that class yourself and instead instruct users to download it themself, even if the class is GPL compatible. See http://drupal.org/project/libraries