Drupal - Common Do's, Don'ts

If you are starting up a Drupal project or you are analyzing one, here are a few Do's and Don'ts:
1. When you are developing with Drupal you will be required to create custom modules or extend existing modules. Please remember that Drupal is a developing product and therefore to manage upgrades they recommend a few standards. The first one is that any custom modules you develop should NOT be under the modules folder. Create them under the /sites/all folder. You can still install them and configure them from the administrative interface. This way custom modules are isolated from Drupal core modules.

2. It is tempting in Open Source frameworks to modify the core code. This is generally not necessary in Drupal. As an example, to create a custom block in a profile page with user information, you need not modify the User module. You can add a file called template.php in your theme's folder. You can then override the theme_user_profile method, by adding a _user_profile method.

3. Similarly, it is a common requirement to select a subset of content at some point. Let us say your content depends on an additional key such as department. So for a particular department you want to show content only for that department. You should NOT modify the node module to accomplish this. The node module and other core Drupal modules allow you to modify the queries they send to the database by using the db_rewrite_sql hook. You can add your own custom filters (such as the department id) to a query created by the node module by overriding that hook.

4. If you do modify core Drupal modules, keep track of which were modified and where, by using commenting patterns.

5. Use the Filtered HTML filter always in user content so that you can protect the site from Cross-site Scripting attacks.

6. Use the .install files in your custom modules to install custom tables in the database. Avoid creating your own MySql (or Postgres) scripts to run separately.

7. If you are using Ajax in a Drupal site use the JQuery functions instead of rolling your own. JQuery is packaged with Drupal and it is easier handling Ajax through it.

The key idea is that when you think of modifying core Drupal code, most of the time you can get away by extending existing modules, or adding hooks. The framework is built with the idea that it should be extensible, not mutable. If you spend some time figuring out the way to extend a module (instead of hacking into the core modules) you will avoid lots of headache later.