Never Trust User Input
Sanitise Everything
Writing Secure Code for Drupal
XSS - if an attacker can execute JS or SQL injection, they can own your site
What sort of data are we getting from users?
Is it sensitive data?
How and where are we storing and transmitting user data?
Do we need to encrypt it?
Accessibility
Keyboard users
Hiding text appropriately?
Hover and focus
https://www.a11yproject.com/checklist/
Getting accessibility right is difficult.
Knowing how to apply appropriate ARIA roles takes time and energy.
But you can get a long way with a few basic rules of thumb.
Maintainability
Reinventing the wheel
Appropriate API usage
Unit test coverage
Comments
Code smells
Larry Garfield at DrupalCon London 2011
https://www.youtube.com/watch?v=Z78ZP_UtaKE
And
Or
If
Testability
Documentation
Tight Coupling
Impurity
What is a code smell?
A sign of possible problems.
Not rules, but guidelines
These ideas are also applicable to other languages
I learned from Larry in Croydon - 7 common code smells
And - Functions that do too much
Or - functions that sometimes do different things
If - excessive complexity
Testability - can it be tested? if not, bad sign
Docs - comments
Tight Coupling - dependent on other parts of system
Impurity - side effects plus return values
Set up your IDE:https://www.drupal.org/docs/develop/development-tools
Pre-commit hooks:https://github.com/geraldvillorente/drupal-pre-commit
Static analysis with Jenkins:http://reload.github.io/jenkins-drupal-template/
I'm a big coding standards pedant - improve signal to noise in dev and code review
But adding comments about whitespace is pretty tedious
So get machines to do the boring work for you
appropriate level depends on size of your team
Integrate PHPCodeSniffer with your IDE
Pre-commit hooks
Integrate your CI server with your pull requests
If it breaks coding standards, the code doesn't get merged
If the unit tests fail, the code doesn't get merged
If it is horrendously complex, the code doesn't get merged