Using Drupal 5.14 with Profile Module to add a phone field when creating a new account. (username, e-mail address, phone)

However, anything can be added to the text phone field. There is no check as to illegal characters. Seems that this would be security hole.

It is expected if "?><@#$" etc is added to the field that an error message would be generated saying "illegal characters are entered" and the entered data would not be accepted.

Until this get resolved, would it be a good suggestion to change the field type from 'text' to 'varchar (12)' in the database for profile_values value?

Live Site
Drupal 5.14
MySQL 5.0.67
PHP 5.2.6
Apache/2.2.10 (Unix)

and

WAMP Site
Drupal 5.14
MySQL 5.0.51b
PHP 5.2.6
Apache/2.2.8 (Win 32)

Comments

drumm’s picture

drumm
he/him
Location NY, US
commented
Status: Active » Closed (works as designed)

Drupal only checks for valid values on input. Username and email have extra checking because they should follow a certain format. Profile fields are free-form, so there is little validation. Filtering is done on output, for more information see http://drupal.org/node/263002. If you do find a way to put in HTML or JS that is executed in the browser, please directly email security@drupal.org and do not open a public issue, see http://drupal.org/node/101494.

Since profile fields are so free-form, your phone number is saved in the same column as another site's bio, the fields are the text type.

You may want to look into a module which specifically adds phone number fields, which can have a different column type and additional validation.