1

I'm doing a Drupal 7 module course. We're building a function in an include file that takes and argument from the URL. It then prints the value to the page. Seems simple enough, but then he does this in the example:

function good_morning_extra($wildcard) {
$content = array(
'#type' => 'markup',
'#markup' => '<p>' . t('The wildcard contains the value "%wildcard".', array('%wildcard' => $wildcard)) . '</p>',
);

return $content;
}

It's this part that has me confused, and the instructor glossed over it: 'The wildcard contains the value "%wildcard".', array('%wildcard' => $wildcard) Why not just 'The wildcard contains the value "' . $wildcard .'"</p>'?

It prints out the same, but I'm wondering if there's something to learn here. I'm still learning the whole "renderable array" syntax and exactly what that means. I have a feeling understanding this may be key to me understand how Drupal passes data around.

1

The docs for format_string() should clear up the confusion:

  • @variable: Escaped to HTML using check_plain(). Use this as the default choice for anything displayed on a page on the site.
  • %variable: Escaped to HTML and formatted using drupal_placeholder(), which makes it display as emphasized text.
  • !variable: Inserted as is, with no sanitization or formatting. Only use this for text that has already been prepared for HTML display (for example, user-supplied text that has already been run through check_plain() previously, or is expected to contain some limited HTML tags and has already been run through filter_xss() previously).

So in the specific case you've provided, %wildcard is used to ensure that the value is :

Escaped to HTML and formatted using drupal_placeholder(), which makes it display as emphasized text.

The different placeholder types are simply used in different situations, depending on what you need to do with the value, and whether or not you trust its source.

The docs for t() are also worth a read for extra context.

  • Ah, so it's for sanitizing url input? I tried to add a script console.log to the url, didn't work, but I guess it's a security issue. – icicleking May 21 '15 at 13:23
  • Pretty much - t() is a wrapper around strtr(), it just happens to provide some sugar (sanitising/emphasis/etc) because it makes more sense to do that at the same time than to run the string through two different methods – Clive May 21 '15 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.