I'm using Drupal 7. My question regards the sanitization of the "q" parameter. We know about SQL injection, so I was wondering if this parameter may be a vector for this kind of security flaw. I've searched the Drupal core files for the $_GET['q'] string. It is used several times but I could't find any kind of sanitization. Perhaps I've missed something.

My opinion is that Drupal does not uses the $_GET['q'] inside any kind of query or if it does it will be sanitized by the database API itself.