Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases now! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Drupal 10 Module Development

You're reading from   Drupal 10 Module Development Develop and deliver engaging and intuitive enterprise-level apps

Arrow left icon
Product type Paperback
Published in Apr 2023
Publisher Packt
ISBN-13 9781837631803
Length 580 pages
Edition 4th Edition
Languages
Tools
Concepts
Arrow right icon
Author (1):
Arrow left icon
Daniel Sipos Daniel Sipos
Author Profile Icon Daniel Sipos
Daniel Sipos
Arrow right icon
View More author details
Toc

Table of Contents (21) Chapters Close

Preface 1. Chapter 1: Developing for Drupal 2. Chapter 2: Creating Your First Module FREE CHAPTER 3. Chapter 3: Logging and Mailing 4. Chapter 4: Theming 5. Chapter 5: Menus and Menu Links 6. Chapter 6: Data Modeling and Storage 7. Chapter 7: Your Own Custom Entity and Plugin Types 8. Chapter 8: The Database API 9. Chapter 9: Custom Fields 10. Chapter 10: Access Control 11. Chapter 11: Caching 12. Chapter 12: JavaScript and the Ajax API 13. Chapter 13: Internationalization and Languages 14. Chapter 14: Batches, Queues, and Cron 15. Chapter 15: Views 16. Chapter 16: Working with Files and Images 17. Chapter 17: Automated Testing 18. Chapter 18: Drupal Security 19. Index 20. Other Books You May Enjoy

Cross-Site Scripting (XSS)

With the adoption of Twig as the templating system, prevention against XSS attacks has been significantly improved. There are two main consequences of this adoption. The first one addresses the need for separating presentation from business logic. In other words, themers and developers can no longer directly access Drupal’s APIs, nor can they run SQL queries from templates. To expose any such functionality, Twig extensions and filters can be used, but they require the logic to be encapsulated inside a module.

The second consequence is in the form of Twig auto-escaping. This means that any string not specifically marked as safe will be escaped by Twig using the native PHP htmlspecialchars() function.

Sanitization methods in Drupal

Twig auto-escapes any string that is output using the normal notation, as follows:

{{ variable_name }}

However, there are cases in which the variable has already been marked safe, and Twig no longer escapes...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime