How to save POST variables securely using entity api I am creating a module that connects Drupal Commerce to Shipworks (a shipping management system). They communicate with each other using HTTP POSTs via a single endpoint URL on Drupal. One aspect I am trying to understand is how to handle the POST variables returned from Shipworks in a secure manner.

For example, when a shipment is created in Shipworks the corresponding order id ($_REQUEST['order']) and tracking number ($_REQUEST['tracking']) are posted to Drupal at the endpoint. How do I save the tracking number in a secure manner using the entity api? Can I use the following code? 

if (is_int($_REQUEST['order'])) {
  $order_id = $_REQUEST['order'];
}
else {
  _outputError(40, "Not a valid order id.");
}

$order = commerce_order_load($order_id);

$order_wrapper = entity_metadata_wrapper('commerce_order', $order);

$tracking = $_REQUEST['tracking'];

$tracking_number = str_replace(' ', '', strtoupper($tracking));

$order_wrapper-&gt;field_tracking_numbers-&gt;set($tracking_number);
$order_wrapper-&gt;save();
It really depends on how ShipWorks works. If it lets you specify a URL when it downloads the order data, you could use a secret key appended to the URL that you can use to authenticate a request as Ayeshk mentions. If it allows the merchant to specify a URL in a configuration form, at least you can set the secret key once and have the merchant copy it, kind of like how Drupal appends a secret key to the cron URL.

I also have a project upcoming that requires ShipWorks. Are you sharing the code publicly anywhere?