Markup filtering at theme level (security) Please could someone advise if any sort of sanitization/filtering is required for the #markup below i.e. check_markup(), check_plain(), etc

The $title variable is basically just from drupal_get_title().

function THEME_form_store_search_page_alter(&amp;$form, &amp;$form_state){

        // Some code goes here to remove title from page and use in form (not part of the question)

    $form['title'] = array(
        '#type' =&gt; 'item',
        '#markup' =&gt; '&lt;h1&gt;' . $title . '&lt;/h1&gt;',
        '#weight' =&gt; -100,
    );

}
Rather than remembering specific rules about which variables are safe at which point in the process I suggest you just test things out.

If you can execute Javascript by entering it as the title then you know you have a problem. I try each of these two example snippets of javascript when I want to test something:

&lt;script&gt;alert('xss');&lt;/script&gt;
&lt;img src="notfound.png" onerror="alert('xss');"&gt;


If your sanitization is working properly then you should either see the tags escaped (displayed as &gt;) or stripped (completely removed from the output).

It is also good to understand the internal workings of Drupal so that you know which functions are safe or not, but knowing how to test for XSS will serve you well in dealing with areas where you are unsure or working with something other than the API.