Drupal Module Development & API Flashcards

What is the correct way to define a custom Drupal permission that can be assigned to roles?

Answer: Declare it in the module's .permissions.yml file

Custom permissions are declared in a module's .permissions.yml file with a machine name, title, description, and optional restrict access flag.

In Drupal's Twig templating system, how do you safely output a variable to prevent XSS?

Answer: {{ variable }}

The {{ variable }} syntax in Twig automatically escapes output, preventing XSS attacks; use |raw only when the value is already sanitized markup.

What does hook_schema() define in a Drupal module?

Answer: Database table structure installed by the module

hook_schema() returns an array describing database tables the module needs, which Drupal uses during module installation via drupal_install_schema().

Which Drupal API service should be used to send HTTP requests to external APIs from custom code?

Answer: \Drupal::httpClient() (Guzzle wrapper)

\Drupal::httpClient() returns a pre-configured Guzzle HTTP client that integrates with Drupal's caching and testing infrastructure for external HTTP requests.

What is the purpose of the update_N() function in a Drupal module's .install file?

Answer: Apply database schema or data changes during module updates

update_N() functions (e.g., mymodule_update_9001) run during drush updb to perform one-time schema alterations or data migrations when a module version changes.

In Drupal, what is the 'State API' used for versus the 'Configuration API'?

Answer: State stores runtime server-specific values; Configuration stores deployable site settings

The State API stores environment-specific runtime values (like last cron run time) that should NOT be exported; Configuration API stores settings that should travel with the codebase.