Index: includes/form.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/form.inc,v
retrieving revision 1.503
diff -u -p -r1.503 form.inc
--- includes/form.inc	13 Oct 2010 13:43:21 -0000	1.503
+++ includes/form.inc	16 Oct 2010 20:26:20 -0000
@@ -527,6 +527,7 @@ function form_state_keys_no_cache() {
     'groups',
     'input',
     'method',
+    'skip_validation',
     'submit_handlers',
     'submitted',
     'executed',
@@ -1130,6 +1131,12 @@ function _form_validate(&$elements, &$fo
   // Also used in the installer, pre-database setup.
   $t = get_t();
 
+  // Initialize 'skip_validation' property to FALSE to prevent this flag from
+  // being used in a wrong way.
+  if (isset($form_id)) {
+    $form_state['skip_validation'] = FALSE;
+  }
+
   // Recurse through all children.
   foreach (element_children($elements) as $key) {
     if (isset($elements[$key]) && $elements[$key]) {
@@ -1137,10 +1144,43 @@ function _form_validate(&$elements, &$fo
     }
   }
 
+  // Skip validation if any nested element contains a non-recoverable form
+  // validation error, which could lead to invalid data being processed by form
+  // validation handlers.
+  if ($form_state['skip_validation']) {
+    return;
+  }
+
   // Validate the current input.
   if (!isset($elements['#validated']) || !$elements['#validated']) {
     // The following errors are always shown.
     if (isset($elements['#needs_validation'])) {
+      // Verify that the submitted value contains valid UTF-8.
+      if (isset($elements['#value'])) {
+        $is_valid_utf8 = TRUE;
+        if (is_array($elements['#value'])) {
+          foreach ($elements['#value'] as $value) {
+            if (!drupal_validate_utf8($value)) {
+              $is_valid_utf8 = FALSE;
+            }
+          }
+        }
+        elseif (!drupal_validate_utf8($elements['#value'])) {
+          $is_valid_utf8 = FALSE;
+        }
+        // In case there is any invalid UTF-8 value, throw a form validation
+        // error to reject the form submission and set a flag in $form_state
+        // to skip invocation of any other form (validation) handlers.
+        if (!$is_valid_utf8) {
+          form_error($elements, $t('An illegal value has been detected. Please contact the site administrator.'));
+          watchdog('form', 'Invalid UTF-8 value in %name element.', array(
+            '%name' => empty($elements['#title']) ? $elements['#parents'][0] : $elements['#title'],
+          ), WATCHDOG_ERROR);
+
+          $form_state['skip_validation'] = TRUE;
+        }
+      }
+
       // Verify that the value is not longer than #maxlength.
       if (isset($elements['#maxlength']) && drupal_strlen($elements['#value']) > $elements['#maxlength']) {
         form_error($elements, $t('!name cannot be longer than %max characters but is currently %length characters long.', array('!name' => empty($elements['#title']) ? $elements['#parents'][0] : $elements['#title'], '%max' => $elements['#maxlength'], '%length' => drupal_strlen($elements['#value']))));