Securing Drupal Node Field Values
posted by scales on 5/18/11
When using Drupal input formats with HTML Filtered enabled, the text gets passed through a variaty of functions which sanazite the user input. The HTML Filter removes harmfull content such as iframes, javascript and inline CSS. Drupal by default, stores the raw value in the database so that developers have fine control on how they want to output that variable. This blog article talks about the difference between the value, safe, and view variables and best practices in saving and outputting safe node values.
