Paranoid Form Validator 6.x-1.0

Paranoid Form Validator can be used to prevent security attacks (cross-site scripting, SQL injection) carried out by submitting forms with malicious data in some cases. It works by adding extra validation to forms and raising error if unsafe data were submitted in form fields.Usually these attempts would not be a real threat if the module developers properly verified every input data. But rarely, errare humanum est, developers make mistake and leave security holes in the web page (just take a look at Drupal security advisories).This module is for you, if * you are a power user having full understanding the limits of this module (see ongoing #732858: Provide explanation that this is an incomplete and "un-Drupal" way of handling the problem),and * your site does not need formatted user input, every data entered is simple plain text, so you can afford getting rid of rich input, and * or you are developing a module and you feel insecure if you really put check_plain everywhere, * or you use modules which you are not sure the quality of.Usage.This module can reject any submitted form if it finds suspicious data posted. You can control which forms must be checked or which forms are trusted and no need to check. Note that data posted by users with the 'submit unchecked form' permission are not checked. Data posted from the form paranoidvalidator_admin_settings (the admin page of the module) is never checked either.When malicious input found and considered as a possible break-in attempt, an event is triggered so you can assign actions to this trigger. Two sample actions are already present: one to log, one to display the incident. See the Triggers page for more info.Important notes: * This module is not enough to protect an insecure site. It only prevents users to enter malicious data in the future. If your database is already tainted, or your data came elsewhere (e.g. another application), this module does not help you. * Generally it is not the best attitude to filter input data instead of carefully handling data inside the program code. But it is clear that if there is a bug in a module (which you do not indend to fix yourself), this decreases the possibility that a security whole can be exploited. So this module is paranoid because it assumes that some module is buggy. * This module conflicts with any sophisticated input filter methods, it supports only the simplest case where no rich input allowed at all.

Requirements:	No special requirements
Platforms:	PHP
Keyword:	Actions,  Checked,  Developers,  Filter,  Forms,  Handling,  Input,  Insecure,  Malicious,  Module,  Permission,  Present,  Security,  Submitted,  Unchecked,  Users
Users rating:	0/10