Filtering output in drupal 7

Question

I am creating templates using hook_theme. It works fine, but should I be filtering the output? I am accessing it via ['und'][0]['value'], but this doesn't seem right

Specifically in the code below $model_name, $description

function dc_car_guide_theme($existing, $type, $theme, $path){   
    return array(
        'dc_car_makes' => array(
            'variables' => array('makes' => array()),
            'template' => 'theme/makes'
        ),
        'dc_car_models' => array(
            'variables' => array('models' => array(), 'make' => ''),
            'template' => 'theme/models'
        ),      
        'dc_car_model' => array(
            'variables' => array('photos' => array(), 'make' => '', 'model' => '', 'description' => ''),
            'template' => 'theme/model'
        ),      
    );
}


function dc_car_guide_model($model_id)
{
    $model = entity_load_single('field_collection_item', $model_id);
    $host_entity = $model->hostEntity();
    $make_node = node_load($host_entity->nid);
    $model_name = $model->field_model_name['und'][0]['value'];
    $description = $model->field_writeup['und'][0]['value'];

    return theme('dc_car_model', array('photos' => array(), 'make' => $make_node->title, 'model' =>$model_name, 'description' => $description));
}

Answer 1

As an alternative answer, using Entity API module, you could do something like:

function dc_car_guide_model($make_node) {
  // Load parent node, allow passed node object or nid
  $make_node = is_object($make_node) ? $make_node : node_load($make_node);
  // Get entity wrapper for easy access to properties and field values 
  $make_wrapper = entity_metadata_wrapper('node', $make_node);
  // Fetch field values
  $model_name = $make_wrapper->field_collection_item->field_model_name->value();
  $description = $make_wrapper->field_collection_item->field_writeup->value();
  // Output
  return theme('dc_car_model', array('photos' => array(), 'make' => $make_node->title, 'model' =>$model_name, 'description' => $description));
}

As an extra, although the above method is fine for outputting sanitized markup, Drupal provides the following functions for manual sanitizing of variables

• Sanitization functions

See also http://drupal.org/writing-secure-code for information on writing secure code.

Answer 2

PLease, read Rendering Drupal 7 fields (the right way).
So you'll get next:

<?php
function dc_car_guide_model($model_id) {
  $model = entity_load_single('field_collection_item', $model_id);
  $host_entity = $model->hostEntity();
  $make_node = node_load($host_entity->nid);

  $field = field_get_items('node', $make_node, 'field_model_name');
  $model_name = render(field_view_value('node', $make_node, 'field_model_name', $field[0])); // Remove render, if you want work with arrays on theme function.

  $field = field_get_items('ENTITY', $model, 'field_writeup');
  $description = render(field_view_value('ENTITY', $model, 'field_writeup', $field[0])); // Not sure is this correct, since I don't have info about your entity.

  return theme('dc_car_model', array('photos' => array(), 'make' => $make_node->title, 'model' =>$model_name, 'description' => $description));
}