How does creating contacts via civicrm_api3() fit into these areas https://docs.civicrm.org/dev/en/latest/security/#strategy https://docs.civicrm.org/dev/en/latest/security/inputs ?

If I'm using this inside custom drupal modules, is it safe to simply:

function mycustom_webform_submission_insert($node, $submission) {
  if ($node->nid == 123) {
    civicrm_api3('Contact', 'create', array(
      'sequential' => 1,
      'contact_type' => 'Organization',
      'contact_sub_type' => 'Sub Type Name',
      'organization_name' => $submission->data[48][0],
      // I've done nothing to that $submission data, it's only been processed by whatever Drupal/Webform module do.
      // Is that a security risk?
  • 2
    Yes that would be safe to do so. Assuming that the drupal framework did some sanitation and that the civicrm api has its sanitazion. But that also depends on the context your form is used. Mar 5, 2018 at 9:45

1 Answer 1


The Drupal Webform module sanitises form inputs.

The Webform CiviCRM Integration module uses the underlying webform submission functions to sanitise data.

However the accepted answer on this question makes a very valid point.

It's a common misconception that user input can be filtered. PHP even has a >(now deprecated) "feature", called magic-quotes, that builds on this idea. It's nonsense. Forget about filtering (Or cleaning, or whatever people call it). What you should do, to avoid problems, is quite simple: whenever you embed a string within foreign code, you must escape it, according to the rules of that language.

Both modules mentioned above are covered by the Drupal security advisory policy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.