1

I need to make a direct link to page which needs the uid in the URL.

Can someone suggest a better way to do this in a block? Does Input Format PHP code open some unnecessary attack vectors? Are input filters or tokens in blocks possible?

<?php 
global $user; 
?>   
.
.
.
<li>
   <a href="/user/<?php echo $user->uid ?>/fboauth?destination=stream">Facebook Deauthorize</a>
</li>

This is a legacy site running 6.28 using FBOauth.

Improve this question
5
  • What is the block for that you need to use Input Format PHP? You should be creating your own block module for blocks that require custom PHP. Custom PHP inside any kind of form is an issue.
    – Steven
    Commented Sep 19, 2013 at 18:12
  • So custom hook_block() with the content of the block sent through $block['content'] => $custom_content; ?
    – Rick
    Commented Sep 19, 2013 at 18:15
  • Yes :) that is what I meant.
    – Steven
    Commented Sep 19, 2013 at 18:16
  • Wanna throw that in the answer below?
    – Rick
    Commented Sep 19, 2013 at 18:27
  • +5 for asking if there's a better way than php module. :)
    – Letharion
    Commented Sep 19, 2013 at 21:08

1 Answer 1

Reset to default
3

You should be creating your own block module for blocks that require custom PHP, custom PHP inside a form field is not very good security wise because of the way the PHP is parsed.

A custom block meaning

custom_hook_block() with the $block['content'] =>

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.