CHAPTER 12 ■ MANIPULATING USER INPUT: THE FILTER SYSTEM

A common use for a filter is to remove unwanted markup from user-submitted input. Figure 12-2 shows Drupal’s HTML filter at work.

Figure 12-2. The Limit allowed HTML tags filter allows only certain tags through. This filter is essential for preventing cross-site scripting attacks.

Filters and Text formats

Trying to find a list of installed filters within the administrative interface isn’t intuitive and assumes you already understand what filters do to know what to look for. For filters to perform their jobs, you must assign them to a Drupal Text format as shown in Figure 12-3. Text formats group filters together so they can run as a batch when processing content. This is much easier than checking off a handful of filters for each submission. To view a list of installed filters, either configure an existing Text format or create a new one by clicking on the Configuration link at the top of the page, followed by the Text format link on the Configuration page and the Add text format link.

■ Tip A Drupal text format is made up of a collection of filters.

296

CHAPTER 12 ■ MANIPULATING USER INPUT: THE FILTER SYSTEM

Figure 12-3. Installed filters are listed on the “Add text format” form.

Drupal ships with three text formats (see Figure 12-4):

•The Filtered HTML text format is made up of four filters:

•The Limit allowed HTML tags filter, which restricts which tags are allowed to pass through the filter

•The Convert URLs into links filter, which transforms web and e-mail addresses into hyperlinks

297

CHAPTER 12 ■ MANIPULATING USER INPUT: THE FILTER SYSTEM

•The Convert line breaks into HTML line break converter, which converts carriage returns to their HTML counterparts

•The Correct faulty and chopped off HTML filter

•The Full HTML text format doesn’t use the Limit allowed HTML tags filter, but does implement the Convert URLs into links, Convert line breaks into HTML, and Correct faulty and chopped off HTML filters.

•The Plain Text text format, which displays HTML tags as plain text

•The PHP Code text format is made up of a filter called PHP evaluator, and its job is to execute any PHP within a post. A good rule of thumb is never to give users the ability to execute a Text format that uses PHP evaluator. If they can run PHP, they can do anything PHP can do, including taking down your site, or worse yet, deleting all your data. To protect against this possibility, Drupal ships with the PHP evaluator filter disabled. If you must make it available, enable the PHP filter module.

■Caution Enabling the PHP Code Text format for any user on your site is a security issue. Best practice is to not use this Text format. If you must use it, use it sparingly, and only for the superuser (the user with user ID 1).

Figure 12-4. Drupal installs with four configurable text formats by default.

298

CHAPTER 12 ■ MANIPULATING USER INPUT: THE FILTER SYSTEM

Because text formats are collections of filters, they are extensible. You can add and remove filters, as shown in Figure 12-5. You can change the text format’s name, add a filter, remove a filter, or even rearrange the order in which a text format’s filters are executed to avoid conflicts. For example, you might want to run the URL filter before the Correct faulty and chopped off HTML filter runs so the filter can inspect the anchor tags created by the URL filter.

■ Note Text formats (groups of filters) are controlled at the interface level. Developers don’t need to worry about text formats when defining a new filter. That work is left to the Drupal site administrator.

Figure 12-5. Text formats are made up of a collection of filters. Shown in this figure are Drupal’s four default Text formats.

299