I am using the code below to evaluate if a panel pane should display. I've read the docs on database abstraction, but I just don't really understand how to apply it. Of course, the dpm values are for debugging.

(Just to be clear, this code is currently functioning exactly how I need it to, and I am not having any problems with panels itself. I just don't understand how to sanitize this the Drupal way to avoid injection.)

Any help would be appreciated. Here's the code:

// Gets NID of viewed node as well as the parent (passed by entity reference field)
$nid = $contexts['argument_entity_id:node_1']->data->nid;
$parent = $contexts['argument_entity_id:node_1']->data->field_webisode_series_reference['und'][0]['target_id'];

// Returns the 3 newest nodes with same parent as the view node
$recentNIDs = db_query("
    SELECT entity_id 
    FROM field_data_field_webisode_series_reference 
    WHERE field_webisode_series_reference_target_id = $parent 
    ORDER BY entity_id 
$result = $recentNIDs->fetchAll();

// Checks NID of the viewed node against NIDs of the 3 nodes above.
// If true, and NIDs match, then the block is displayed.
foreach ($result as $k => $v) {
    $nid2 = $v->entity_id;

    if ($nid2 == $nid) {
        $top3 = 1;

// If $top3 is set, display. Else, do not.
if (isset($top3)) {
    dpm('TRUE', 'top 3?')

elseif (!isset($top3) {
    dpm('FALSE', 'top 3?')
  • 1
    You might want to check out EntityFieldQuery. As far as displaying the panel I am not sure because I use blocks, maybe this may help.
    – sareed
    Commented Jan 6, 2015 at 21:02
  • I'll take a look at EntityFieldQuery. Actually displaying it is not a problem. There's a "visibility" option within each panel where PHP code can be used to evaluate whether or not it will display. I'm just plugging this code into that spot.
    – Mrweiner
    Commented Jan 6, 2015 at 21:05

1 Answer 1


I think that you can review this answer:

If you use db_query() all the time without directly inserting variables, but using the arguments.

I hope information be useful.

  • That answer explained why to do it, but not as much on how to do it. That being said, it did help me out on my way to figuring it out, so I'll mark this as the answer. That being said, a comment in that answer said to consider using db_escape_table (api.drupal.org/api/drupal/includes!database!database.inc/…). Do you know why/when this should be done, or how I would implement it?
    – Mrweiner
    Commented Jan 11, 2015 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.