I am building a form in Drupal 7. I have a textarea field and would like to know if it is safe to get the field content ($form['values']['field_name']) and save it to the database using something like db_insert, db_update or db_merge. OR do I have to do some sort of filtering to avoid SQL injection attacks. Thank you

1 Answer 1


If you use the Drupal core database API functions, the content will be automatically escaped, preventing SQL injection.

You can run the content through filter_xss prior to insert, otherwise you'll need to do that on display.

Drupal core stores the content unsanitized and sanitizes it on output.

User input should be validated on input and filtered on output.

More info on sanitization functions here: http://api.drupal.org/api/drupal/includes!common.inc/group/sanitization/7

See also http://drupal.org/writing-secure-code for information on writing secure code.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.