Should QA engineers directly update Drupal database tables via SQL? Is it generally accepted that it's ok in the Drupal community for QA testers to directly update and delete data in Drupal core tables via SQL? Or is it considered a bad practice? I'm talking about non-production environments--Production is definitely a no-no.

We are fortunate enough to have dedicated Quality Assurance engineers. I'm a developer and am very cautious about writing SQL update and delete statements on our Drupal tables (again, non-production). We usually script things in drush or use Drupal's API.

I think our QA engineers are great, but it seems like a very risky venture to directly update and delete data in core Drupal tables with SQL, even in non-Prod. I would think using tools such as Selenium or scripted solutions that use an API would be preferred, as long as they provide the same functionality.

Your input would be greatly appreciated. Any links with guidelines on this topic would be extremely helpful too.
If you directly update and delete data in Drupal tables via SQL, you don't allow Drupal core and third-party modules to detect such changes.

Instead, I suggest you have a look at some (common used) modules that may help updating/deleting such data, in "the Drupal way". Just to mention a few:


Flag - eg to "mark" nodes, users, etc for anything that's relevant for testing purposes.
Rules - eg to automagically make all sorts of things happen (eg after something like a node or user got flagged with the Flag module).
Views Bulk Operations (VBO) - to perform mass updates/deletes on a "list" (created with the Views module) of nodes, users, etc, whereas the actual operations to be performed can be "specified" with custom rules (created with Rules), or the other way around where you create such VBO-list and use it as input for creating lists and loops using Rules.


By using the "Drupal way", you also respect its permissions/roles architecture while performing testing (instead of getting around all that via direct updates/deletes). Wouldn't you rather want to discover security holes in testing areas?

Apart from that, there is also the Devel module to facilitate automatically generating nodes, comments, terms, users, and more (for testing purposes).