Sanitization of the q parameter I'm using Drupal 7. My question regards the sanitization of the &quot;q&quot; parameter. We know about SQL injection, so I was wondering if this parameter may be a vector for this kind of security flaw. I've searched the Drupal core files for the $_GET['q'] string. It is used several times but I could't find any kind of sanitization. Perhaps I've missed something.
My opinion is that Drupal does not uses the $_GET['q'] inside any kind of query or if it does it will be sanitized by the database API itself.
The request sanitization is an important part of Drupal security. Probably you can find the most important code in the DrupalRequestSanitizer class.
Here you have the sanitize method:
 /**
   * Modifies the request to strip dangerous keys from user input.
   */
  public static function sanitize() {
    if (!self::$sanitized) {
      $whitelist = variable_get('sanitize_input_whitelist', array());
      $log_sanitized_keys = variable_get('sanitize_input_logging', FALSE);

      // Process query string parameters.
      $get_sanitized_keys = array();
      $_GET = self::stripDangerousValues($_GET, $whitelist, $get_sanitized_keys);
      if ($log_sanitized_keys &amp;&amp; $get_sanitized_keys) {
        _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from query string parameters (GET): @keys', array('@keys' =&gt; implode(', ', $get_sanitized_keys))), E_USER_NOTICE);
      }

      // Process request body parameters.
      $post_sanitized_keys = array();
      $_POST = self::stripDangerousValues($_POST, $whitelist, $post_sanitized_keys);
      if ($log_sanitized_keys &amp;&amp; $post_sanitized_keys) {
        _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from request body parameters (POST): @keys', array('@keys' =&gt; implode(', ', $post_sanitized_keys))), E_USER_NOTICE);
      }

      // Process cookie parameters.
      $cookie_sanitized_keys = array();
      $_COOKIE = self::stripDangerousValues($_COOKIE, $whitelist, $cookie_sanitized_keys);
      if ($log_sanitized_keys &amp;&amp; $cookie_sanitized_keys) {
        _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from cookie parameters (COOKIE): @keys', array('@keys' =&gt; implode(', ', $cookie_sanitized_keys))), E_USER_NOTICE);
      }

      $request_sanitized_keys = array();
      $_REQUEST = self::stripDangerousValues($_REQUEST, $whitelist, $request_sanitized_keys);

      self::$sanitized = TRUE;
    }
  }

There a few more functions but this one is the most important.
As you think sanitizing request input is very important. One of the worst Drupal core issues were related to this (in fact, this file was patched, if I'm not wrong). See &quot;Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002&quot; security report.
Implications
Given Drupal has a Security Team you don't have to worry about request sanitization unless you develop your own code that deals directly with the request.