I have a tpl.php page for login form in my drupal site in which have 4 images.

I need to display only one of these 4 images randomly on each page load.

I can easily do this in less than 10 lines of code using the php rand() function.

But is it advisable to directly use such functions in tpl files. Could this have some sort of security risk?


The 4 images that I talked about. I have just uploaded them to sites/default/files/images folder and have included them in tpl file using following code:

<img src="http://mysite.com/sites/default/files/images/image.jpg"/>

I have a feeling that this is unsafe too. Please advise.

  • 1
    Security risk, not so much. But you will have problems with caching. Templates should be used for display only; all business logic should go elsewhere, namely in a template preprocess function
    – Clive
    Commented Nov 12, 2013 at 11:02
  • @Clive: Thanks. Also, Please see the updated question.
    – kmdhrm
    Commented Nov 12, 2013 at 11:13
  • Your update falls under "not best practice", but why do you consider it to be unsafe? What attack vector do you feel you're introducing, or opening up?
    – Clive
    Commented Nov 12, 2013 at 11:18
  • I have read that when uploading a file file_save_upload may be used which gives the file a temporary status and these files are periodically cleaned. If I directly upload a file, could there be a similar issue?
    – kmdhrm
    Commented Nov 12, 2013 at 11:25
  • 1
    If someone has told you that showing the full path to an image located on a website is a security risk - stop listening to them :) Then get them to read this
    – Clive
    Commented Nov 12, 2013 at 11:31

1 Answer 1


For the first part of question:

You may output as form item the output of your custom function, where contain logic to get random image:

function MY_MODULE_form_alter(&$form, &$form_state, $form_id) {
    if ($form_id == 'user_login') {
        $form['img_item'] = array(
          '#type' => 'markup',
          '#markup' => my_random_image_output(),
          '#weight' => -50

function my_random_image_output() {
    $output = '';

    // your custom logic to output one image $output = '<img src=".... />'

    return $output;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.