Drupal,开发自定义模块,这是正确的做法

Question

下面是drupal自定义模块,

请你确认一下,

是开发自定义模块的正确方法,

否则请告知,

<?php
/**
*  Implementation of hook_form_alter().
*/
function register_form_alter(&$form, $form_state, $form_id) {
  switch($form_id) {
      case 'user_register': // the value we stole from the rendered form
        // your customizations go here
         // drupal_set_message('Hey, we\'ve tapped into this form!');
         $form['account']['bharani'] = array(
            '#title' => 'bharani',
            '#type' => 'textfield',
            '#description' => t(' bharanikumar custom field '),
          );
         $form['#submit'][] = 'register_submit_handler'; // Add this

      break;
  }
}

function register_submit_handler($form, &$form_state) {
  $value = $form_state['values']['bharani'];
  $mail = $_POST['mail'];
  $query  = "UPDATE users SET language='$value' WHERE mail='$mail'";
  db_query($query);
}


?>

Answer 1

我不会回答问题的"开发自定义模块的正确方法"部分,但这里有一个关于您执行SQL查询的方式的说明:

你正在使用这个:

$value = $form_state['values']['bharani'];
$mail = $_POST['mail'];
$query  = "UPDATE users SET language='$value' WHERE mail='$mail'";
db_query($query);

有了这个,您的代码就会受到SQL注入的影响:无论用户将发送什么内容$_POST['mail'],它都会在查询中结束,无需转义!

使用Drupal db_query(),您应该使用以下内容:

$value = $form_state['values']['bharani'];
$mail = $form_state['values']['mail'];;
$query  = "UPDATE users SET language='%s' WHERE mail='%s'";
db_query($query, $value, $mail);

这样,Drupal将负责转义,保护您免受SQL注入.