diff --git a/mod/data/backup/moodle2/restore_data_stepslib.php b/mod/data/backup/moodle2/restore_data_stepslib.php
index 8c6744192d2..efc0ef3e8fd 100644
--- a/mod/data/backup/moodle2/restore_data_stepslib.php
+++ b/mod/data/backup/moodle2/restore_data_stepslib.php
@@ -87,6 +87,7 @@ class restore_data_activity_structure_step extends restore_activity_structure_st
         $oldid = $data->id;
 
         $data->dataid = $this->get_new_parentid('data');
+        $data->type = clean_param($data->type, PARAM_ALPHA);
 
         // insert the data_fields record
         $newitemid = $DB->insert_record('data_fields', $data);
diff --git a/mod/data/classes/local/importer/csv_entries_importer.php b/mod/data/classes/local/importer/csv_entries_importer.php
index d295b9bbf85..a3b9064d1ca 100644
--- a/mod/data/classes/local/importer/csv_entries_importer.php
+++ b/mod/data/classes/local/importer/csv_entries_importer.php
@@ -103,6 +103,7 @@ class csv_entries_importer extends entries_importer {
                         unset($fieldnames[$id]); // To ensure the user provided content fields remain in the array once flipped.
                     } else {
                         $field = $rawfields[$name];
+                        $field->type = clean_param($field->type, PARAM_ALPHA);
                         $filepath = "$CFG->dirroot/mod/data/field/$field->type/field.class.php";
                         if (!file_exists($filepath)) {
                             $errorfield .= "'$name' ";
diff --git a/mod/data/lib.php b/mod/data/lib.php
index df720b515e1..7715a3e4279 100644
--- a/mod/data/lib.php
+++ b/mod/data/lib.php
@@ -1051,6 +1051,7 @@ function data_get_field_from_id($fieldid, $data){
 function data_get_field_new($type, $data) {
     global $CFG;
 
+    $type = clean_param($type, PARAM_ALPHA);
     $filepath = $CFG->dirroot.'/mod/data/field/'.$type.'/field.class.php';
     // It should never access this method if the subfield class doesn't exist.
     if (!file_exists($filepath)) {
@@ -1078,6 +1079,7 @@ function data_get_field(stdClass $field, stdClass $data, ?stdClass $cm=null): da
     if (!isset($field->type)) {
         return new data_field_base($field);
     }
+    $field->type = clean_param($field->type, PARAM_ALPHA);
     $filepath = $CFG->dirroot.'/mod/data/field/'.$field->type.'/field.class.php';
     if (!file_exists($filepath)) {
         return new data_field_base($field);
diff --git a/mod/data/locallib.php b/mod/data/locallib.php
index df4d1c75f70..de36ed31360 100644
--- a/mod/data/locallib.php
+++ b/mod/data/locallib.php
@@ -976,6 +976,7 @@ function data_get_tag_title_field($dataid) {
         if ($field->addtemplateposition === false) {
             continue;
         }
+        $field->type = clean_param($field->type, PARAM_ALPHA);
         $filepath = $CFG->dirroot . '/mod/data/field/' . $field->type . '/field.class.php';
         if (!file_exists($filepath)) {
             continue;
@@ -1019,6 +1020,7 @@ function data_get_tag_title_for_entry($field, $entry) {
     if (!isset($field->type)) {
         return null;
     }
+    $field->type = clean_param($field->type, PARAM_ALPHA);
     $filepath = $CFG->dirroot . '/mod/data/field/' . $field->type . '/field.class.php';
     if (!file_exists($filepath)) {
         return null;