Home/ Questions/Q 7643685
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-31T09:30:27+00:00

I asked this question about reasons to use Drupal 7’s Forms API as opposed

  • 0

I asked this question about reasons to use Drupal 7’s Forms API as opposed to just processing form submission requests myself and eventually calling a function like node_save() or comment_save(). while a variety of reasons were given for using the Forms API, only one possible security vulnerability was raised: by not using Drupal 7’s Forms API, I’d be missing out on the CSRF prevention techniques it uses. From what I’ve read, this basically involves the use of a token for validating requests.

My question is twofold:

  1. Is it possible to leverage Drupal’s token method of CSRF prevention in the script I write to process the Ajax request, thereby entirely eliminating the added risk I’m assuming by not using the Forms API? If so, how?
  2. Does the Forms API employ techniques beyond the use of tokens that I should also implement?

Please note that I do not want this question to become a discussion of whether I should use the Forms API or not.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The token is generated by drupal_get_token() and validated using drupal_valid_token().

    • 0