Answers.Body: <p>The Drupal <a href="https://www.drupal.org/project/webform" rel="nofollow noreferrer">Webform</a> module sanitises form inputs.</p>
  
  <p>The <a href="https://www.drupal.org/project/webform_civicrm" rel="nofollow noreferrer">Webform CiviCRM Integration</a> module uses the underlying webform submission functions to sanitise data.</p>
  
  <p><strong>However</strong> the <a href="https://stackoverflow.com/questions/129677/whats-the-best-method-for-sanitizing-user-input-with-php">accepted answer on this question</a> makes a very valid point.</p>
  
  <blockquote>
    <p>It's a common misconception that user input can be filtered. PHP even has a >(now deprecated) "feature", called magic-quotes, that builds on this idea. It's nonsense. Forget about filtering (Or cleaning, or whatever people call it).
    What you should do, to avoid problems, is quite simple: whenever you embed a string within foreign code, you must escape it, according to the rules of that language.</p>
  </blockquote>
  
  <p><em>Both modules mentioned above are covered by the Drupal <a href="https://www.drupal.org/security-advisory-policy" rel="nofollow noreferrer">security advisory policy</a>.</em></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-06-05T17:58:07.817Z
Answers.LastActivityDate: 2018-06-05T17:58:07.817Z
Answers.UserDisplayName: HomoTechsual
Body: <p>How does creating contacts via civicrm_api3() fit into these areas <a href="https://docs.civicrm.org/dev/en/latest/security/#strategy" rel="nofollow noreferrer">https://docs.civicrm.org/dev/en/latest/security/#strategy</a>
  <a href="https://docs.civicrm.org/dev/en/latest/security/inputs" rel="nofollow noreferrer">https://docs.civicrm.org/dev/en/latest/security/inputs</a>
  ?</p>
  
  <p>If I'm using this inside custom drupal modules, is it safe to simply:</p>
  
  <pre><code>function mycustom_webform_submission_insert($node, $submission) {
    if ($node-&gt;nid == 123) {
      civicrm_api3('Contact', 'create', array(
        'sequential' =&gt; 1,
        'contact_type' =&gt; 'Organization',
        'contact_sub_type' =&gt; 'Sub Type Name',
        'organization_name' =&gt; $submission-&gt;data[48][0],
        // I've done nothing to that $submission data, it's only been processed by whatever Drupal/Webform module do.
        // Is that a security risk?
      ));
    }
  }
  </code></pre>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-03-05T09:45:58.413Z
Comments.Text: Yes that would be safe to do so. Assuming that the drupal framework did some sanitation and that the civicrm api has its sanitazion. But that also depends on the context your form is used.
Comments.UserDisplayName: Jaap Jansma - CiviCooP
Tags: <drupal><api><security>
Title: what kind of sanitization needs to be done when doing civicrm_api3('Contact', 'create') inside custom drupal modules?
ThreadText: # what kind of sanitization needs to be done when doing civicrm_api3('Contact', 'create') inside custom drupal modules?
  
  (Asked by: username_0 on 2018-02-08)
  
  How does creating contacts via civicrm_api3() fit into these areas https://docs.civicrm.org/dev/en/latest/security/#strategy
  https://docs.civicrm.org/dev/en/latest/security/inputs
  ?
  If I'm using this inside custom drupal modules, is it safe to simply:
  function mycustom_webform_submission_insert($node, $submission) {
    if ($node->nid == 123) {
      civicrm_api3('Contact', 'create', array(
        'sequential' => 1,
        'contact_type' => 'Organization',
        'contact_sub_type' => 'Sub Type Name',
        'organization_name' => $submission->data[48][0],
        // I've done nothing to that $submission data, it's only been processed by whatever Drupal/Webform module do.
        // Is that a security risk?
      ));
    }
  }
  
  **Tags:** drupal, api, security
  
  > **Comments:**
  > **username_1**: Yes that would be safe to do so. Assuming that the drupal framework did some sanitation and that the civicrm api has its sanitazion. But that also depends on the context your form is used.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2018-06-05. Score: 2 | Accepted answer
  
  The Drupal [Webform](https://www.drupal.org/project/webform) module sanitises form inputs.
  
  The [Webform CiviCRM Integration](https://www.drupal.org/project/webform_civicrm) module uses the underlying webform submission functions to sanitise data.
  
  **However** the [accepted answer on this question](https://stackoverflow.com/questions/129677/whats-the-best-method-for-sanitizing-user-input-with-php) makes a very valid point.
  
  > It's a common misconception that user input can be filtered. PHP even has a >(now deprecated) "feature", called magic-quotes, that builds on this idea. It's nonsense. Forget about filtering (Or cleaning, or whatever people call it).
  > What you should do, to avoid problems, is quite simple: whenever you embed a string within foreign code, you must escape it, according to the rules of that language.
  
  *Both modules mentioned above are covered by the Drupal [security advisory policy](https://www.drupal.org/security-advisory-policy).*
  
  
  ---
  
  