While everyone is now aware of SQL injections and 99% of Drupal developers now use placeholders in their db queries, some of other important security aspects are often forgotten.

Today I’ve encountered another example of CSRF (Cross-site request forgery in Wikipedia) in Drupal contributed module.

It’s so easy to create a CSRF security hole while creating a module. Here is the short description of the issue.

read more