I had a question come up that seemed a bit ridiculous at first, but has got me wondering. Is it possible to run any sort of script or SQL injection equivalency on forms that are configured to direct into the Marketing Cloud?

So for example, if I had a Web Collect form that posted into a list in the Marketing Cloud, is there any risk that the end user might be able to manipulate this functionality?

All thoughts are appreciated, thank you all.

1 Answer 1


Marketing cloud has optional form validation which may be turned off:

Web forms that allow full text responses to be submitted run the risk of scripting attacks. These Web forms potentially allow attackers to inject script into Web pages viewed by other users. There are measures to prevent this risk for both Marketing Cloud landing pages and for your own landing page, which are as follows:

  • Marketing Cloud Landing Pages are designed with checks in place that will not allow HTML tags to be submitted.

  • If you host the Web form on your landing page, you can disable the request validation by setting "validationRequest=false."

In addition, here are some known issues:

  • Submitting a NULL date or number value in a Smart Capture form used as a Journey Builder entry event will cause contacts to fail to be injected.

  • Journey Update Contact Activity fails to update integer field types when the Integer length is greater than 6 digits

  • In the Marketing Cloud Administration view, when viewing roles and modifying granular permissions for users, CloudPages appears to have several permissions, such as Schedule, Publish and Unpublish, Export, Save, etc. These permissions can be set to Deny, but CloudPages will not respect this setting.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.