2

I'm trying to get a clearer sense of where security vulnerabilities on my site may lie. At no point in my code do I ever query the MySQL database directly; I always use the Database Abstraction Layer (db_query(), etc). Under what circumstances may this not provide sufficient protection against SQL injection attacks?

I am using Drupal 7.

Improve this question

1 Answer 1

Reset to default
2

If you use db_query() all the time without directly inserting variables, but using the arguments.

For example this is right: db_query("SELECT * FROM {node} WHERE nid = :nid", array(':nid' => $nid)); it's perfect, you don't have to care about something else (except critical bug directly in Drupal).

On the other hand, if you do it directly: db_query("SELECT * FROM {node} WHERE nid = $nid"); you expose your site to SQL Injection.

From my own experience, Drupal alone (without other modules) is very secure and many times we tried to hack it with professionals.

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.