I'm using drupal 7.
My question regards the sanitization of the "q" parameter.
We know about sql injection, so I was wondering if this parameter my be a vector for this kind of security flaw.
I've searched the drupal core files for the `$_GET['q']` string.
It is used several times but I could't find any kind of sanitization.
Perhaps I've missed something.

My opinion is that Drupal does not uses the `$_GET['q']` inside any kind of query or if it does it will be sanitized by the database api itself.