drupal-security

Drupal Security Best Practices

XSS Prevention

Twig (auto-escaping ON by default)

• {{ variable }} — safe, auto-escaped
• {{ variable|raw }} — DANGEROUS, bypasses escaping. Only use for pre-sanitized markup
• {% set markup %}...{% endset %} — auto-escaped when rendered
• {{ variable|striptags }} — strips HTML tags

PHP

• Use $this->t() or new TranslatableMarkup() for user-facing strings
• Use Xss::filter() for user HTML that needs limited tags
• Use Html::escape() for plain text output
• Use #plain_text render element for untrusted text
• NEVER use Markup::create() with user input
• NEVER use #markup with unsanitized content

SQL Injection Prevention

// SAFE: parameterized query
$result = $connection->select('users', 'u')
  ->fields('u', ['name'])
  ->condition('status', 1)
  ->execute();

// SAFE: placeholder in query()
$result = $connection->query('SELECT name FROM {users} WHERE uid = :uid', [':uid' => $uid]);

// DANGEROUS: string concatenation
$result = $connection->query("SELECT * FROM {users} WHERE name = '$name'"); // NEVER DO THIS

Access Control

Route Permissions

my_route:
  path: '/admin/my-page'
  requirements:
    _permission: 'administer my module'

Entity Access

• Always call ->accessCheck(TRUE) on entity queries
• Implement EntityAccessControlHandler for custom entities
• Use AccessResult::allowed(), ::forbidden(), ::neutral() with proper cacheability

// REQUIRED in Drupal 10+
$nodes = \Drupal::entityTypeManager()
  ->getStorage('node')
  ->getQuery()
  ->accessCheck(TRUE)  // MANDATORY
  ->condition('status', 1)
  ->execute();

Permission Definitions

# MODULE_NAME.permissions.yml
administer my module:
  title: 'Administer My Module'
  description: 'Full admin access to My Module settings.'
  restrict access: true  # Only for permissions that allow site takeover

view my content:
  title: 'View My Content'
  description: 'View custom content managed by My Module.'