All Questions
7 questions
0
votes
1
answer
40
views
How to securise custom modules
I'm trying to understand how to securise my custom modules to avoid php insert into custom inputs and SQL injections in my db_query.
For inputs I'm using :
$form['custom'] = array(
'#type' =&...
- 375
1
vote
2
answers
104
views
Is it safe to use $_SESSION to store temporarily a user provided value under multi-step form processing
I have a form which contains an AJAX button press callback. Upon pressing this AJAX button, I want to store temporarily a form element's value before fully processing all the data upon pressing main ...
- 732
1
vote
0
answers
59
views
Keeping sensitive data from appearing in cache_form table
I'm developing a HIPAA compliant site using Drupal 7 that collects some personal sensitive data from users, and this data should be protected. I've already encrypted the data before it's stored in the ...
3
votes
2
answers
718
views
What are the alternatives for storing client side encrypted data?
I want to store client side encrypted data in Drupal 7, so that it is encrypted on the client end, and stored and transmitted in encrypted form. The password is never transmitted or stored on the ...
- 1,269
1
vote
0
answers
298
views
Captcha on login form using the form block module
I am providing the registration form using the form block module. I also have Captcha and Hidden Captcha module enabled on mysite. However i am not getting the option to add a captcha to the ...
- 1,147
2
votes
1
answer
757
views
Will forcing validation on a node save result in security issues or data integrity loss?
I have a content type containing lots of required and conditional fields. Because it can take a bit of time to properly create these nodes, and not all information will always be available to the end-...
- 4,604
5
votes
2
answers
2k
views
Is bypassing Drupal's #token protection against CSRF safe for search forms specifically?
I see that $form['#token'] is employed in drupal_prepare_form() and drupal_validate_form() as a protective measure against cross-site request forgery.
I am wondering about the necessity of this ...
- 302