If there is one fear that most developers experience, it is the fear of security vulnerabilities with the code you have written. Bugs are one thing, but security holes that can be used to expose user data or wreck havoc on the database are the cause of many a nightmare. One of the most common forms of attack is SQL Injection. SQL Injection involves injecting malicious commands into a query, usually via some form of user entry.

Fortunately, Drupal provides the tools to protect your website or application against SQL Injection, as long as you follow best practice.

This is best illustrated with an example. This is a simple, harmless query that selects everything from the node table.......