Take the 2-minute tour ×
Drupal Answers is a question and answer site for Drupal developers and administrators. It's 100% free, no registration required.

I am creating templates using hook_theme. It works fine, but should I be filtering the output? I am accessing it via ['und'][0]['value'], but this doesn't seem right

Specifically in the code below $model_name, $description

function dc_car_guide_theme($existing, $type, $theme, $path){   
    return array(
        'dc_car_makes' => array(
            'variables' => array('makes' => array()),
            'template' => 'theme/makes'
        ),
        'dc_car_models' => array(
            'variables' => array('models' => array(), 'make' => ''),
            'template' => 'theme/models'
        ),      
        'dc_car_model' => array(
            'variables' => array('photos' => array(), 'make' => '', 'model' => '', 'description' => ''),
            'template' => 'theme/model'
        ),      
    );
}


function dc_car_guide_model($model_id)
{
    $model = entity_load_single('field_collection_item', $model_id);
    $host_entity = $model->hostEntity();
    $make_node = node_load($host_entity->nid);
    $model_name = $model->field_model_name['und'][0]['value'];
    $description = $model->field_writeup['und'][0]['value'];

    return theme('dc_car_model', array('photos' => array(), 'make' => $make_node->title, 'model' =>$model_name, 'description' => $description));
}
share|improve this question
    
You are correct to assume raw field values retrieved with ['und'][0]['value'] are unsanitized and thus not secure for direct output. Nikit's answer shows a better approach. –  David Thomas Feb 19 '13 at 22:06

2 Answers 2

As an alternative answer, using Entity API module, you could do something like:

function dc_car_guide_model($make_node) {
  // Load parent node, allow passed node object or nid
  $make_node = is_object($make_node) ? $make_node : node_load($make_node);
  // Get entity wrapper for easy access to properties and field values 
  $make_wrapper = entity_metadata_wrapper('node', $make_node);
  // Fetch field values
  $model_name = $make_wrapper->field_collection_item->field_model_name->value();
  $description = $make_wrapper->field_collection_item->field_writeup->value();
  // Output
  return theme('dc_car_model', array('photos' => array(), 'make' => $make_node->title, 'model' =>$model_name, 'description' => $description));
}

As an extra, although the above method is fine for outputting sanitized markup, Drupal provides the following functions for manual sanitizing of variables

See also http://drupal.org/writing-secure-code for information on writing secure code.

share|improve this answer

PLease, read Rendering Drupal 7 fields (the right way).
So you'll get next:

<?php
function dc_car_guide_model($model_id) {
  $model = entity_load_single('field_collection_item', $model_id);
  $host_entity = $model->hostEntity();
  $make_node = node_load($host_entity->nid);

  $field = field_get_items('node', $make_node, 'field_model_name');
  $model_name = render(field_view_value('node', $make_node, 'field_model_name', $field[0])); // Remove render, if you want work with arrays on theme function.

  $field = field_get_items('ENTITY', $model, 'field_writeup');
  $description = render(field_view_value('ENTITY', $model, 'field_writeup', $field[0])); // Not sure is this correct, since I don't have info about your entity.

  return theme('dc_car_model', array('photos' => array(), 'make' => $make_node->title, 'model' =>$model_name, 'description' => $description));
}
share|improve this answer
    
This doesn't seem to work. field_model_name and field_writeup are both part of a field collection. What is the process for a field collection? –  Chris Muench Feb 20 '13 at 14:06
    
"field_model_name" was fixed on code. for ENTITY you should replace by your entity type: field collection entity, I cann't say how it called. Try first just using "entity" –  Nikit Feb 20 '13 at 21:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.