SQL Injection

SQL Injection still remains a very popular vector attack on vulnerable applications that incorrectly make use of database drivers. Luckily, by using the Drupal database abstraction layer, we go a long way toward ensuring protection against such vulnerabilities. All we have to do is use it correctly.

When it comes to Entity queries, there isn't much we can do wrong. However, when using the Database API directly, as we did in Chapter 8, The Database API, we have to pay attention.

Most of the time, vulnerabilities have to do with improper placeholder management. For example, we should never do things like this:

$database->query('SELECT [column] FROM {table} t WHERE t.name = ' . $variable);  

This is regardless of what $variable is—direct user input or otherwise. Because by using that direct concatenation, malicious users may inject their own instructions and complete the statement in a different way than intended. Instead, we...