The title pretty much says it all.

If a callback is defined in a hook_menu, such as

function mymodule_menu ()
    $items = array();

    $items["mymodule/foo/%"] = array(
        "page callback" => "mymodule_foo",
        "page arguments" => array(2),
        "access arguments" => array("mymodule permission"),
        "type" => MENU_CALLBACK,

    return $items;

function mymodule_foo ($parameter)
    // do stuff

When the callback gets called, has $parameter been sanitized, or is this the responsibility of the module?

I always sanitize in the module, but have never seen this stated either way and haven't found where callbacks get called from core.


In D6

menu_execute_active_handler() calls the callback. However it gets it's arguments from menu_get_item(), which uses arg.

I can't see any sanitizing in any of that. So it looks like the answer is no.

In any case extra sanitizing can't hurt.

| improve this answer | |
  • 1
    Thanks. This confirmed my suspicions, and also reminded me to try replacing space with underscores when searching core files for how something is implemented. – mpdonadio Aug 3 '11 at 0:27
  • Extra sanitizing can hurt because double-escaped special characters can become hard to read. – marcvangend Feb 14 '14 at 15:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.